You can set this on the PMS machine (local firewall in your OS), only allow access from inside your local subnet. (edit: ah apologies, this is not exactly the issue you’re having, it’s Plex web content injecting itself into your server url)
My goal isn’t to disable Remote Access for authenticated users, especially via client apps and devices, but to restrict Remote Access to users who have already logged in and obtained a valid token from the Plex authentication infrastructure.
Plex Web’s behavior has changed. It used to be a big “Login” screen. Now it’s “Here’s a bunch of free content!”.
I understand that the content itself isn’t streamed by my server, it’s still problematic. Providing an index of media can be problematic. I don’t want to be associated with it, don’t want my network provider to associate me with it, but I can’t currently disable it for anonymous users.