An add-on can be published as unlisted to the G Suite Marketplace.
There is a checkbox for:
Unlist Application
Unlisted application won't be shown in browse or search results. It can only be accessed by the direct URL.
If you don't want your add-on to be publicly listed, for example, for use just for a certain company, organization, domain, or group of users.
You'd need to get the user and/or domain account when the code runs, and prevent the add-on from doing anything for any accounts that you don't want to have access. But, it's better than publishing publicly if you want to provide an add-on for a specific client. This is a good option if you want to prevent your code from being accessible to the public.
For any account that isn't authorized to use the add-on, you could remove authorization.
function NameGoesHere_() {
if (!isThisUserAuthorized_()) {
ScriptApp.invalidateAuth();
}
}
To make this setting you will need to navigate to the Publish page of the G Suite Marketplace SDK in your Google Cloud Platform.
