Oops! I misunderstood completely backwards.
You want to keep the space private and publish it on your website.
That seems to be quite a difficult task as the HF token doesn’t seem to work…
I think it would be faster to sift through the users while keeping it public.
You only let the traffic from your site through, and repel the others. (including from HF).
I’m not sure, I’ve never used it, but perhaps you could also gated it and use HF’s read token.
It is often used by companies and other organizations.