I assume that you are doing this through the HGWeb CGI script. If so, you can specify allow_push and allow_read in each .hg/hgrc project file. If you specify allow_read other than * , users who are not on the list do not even see the project on the HGWeb project list page.
source share