not enough info
are you hosting the running of an app?
or are you hosting the development of apps?
running of app(s)
install the RUN TIME ONLY version of APEX, not the one that includes the APEX Developer app
you could possibly hide parts of the URL behind a web proxy.
development of apps
again, maybe a web proxy... (but how would you prevent the use of INTERNAL)???
"but I want to let them develop and run production on the same system"
no you don't.
Developing code on production is a bad 'life cycle development' practice.