If your server is fully responsible for the creation and deletion of rooms and the matchmaking of players into them and...
if your server will give the client a room reservation in some way and...
if your client will only connect to the server with a room reservation using client.consumeSeatReservation and...
if you want to prevent any client from ever creating a room on the server and...
if you do not mind to use a dirty workaround...

...you can override the private (D'OH) property exposedMethods of the Server class:

const gameServer = new Server();
const tempServer = gameServer as any; // force access to private property by casting to any
tempServer.exposedMethods = []; // override property with empty array to not expose those methods anymore
gameServer.listen(port);

Yes, it is dirty, it might break in the future, it might not work for you, but it works perfectly for me and it made me giggle maniacally.