I do not think we have this flexibility at the moment, closest you can probably do is disable fiddling with primary via CSS.
OAuth is keyed on a special key anyway, so the impact of fiddling with primary email should be extremely low, login will still work and be associated to the main fedora account.