My first idea was to have the instance locked behind the YunoHost auth, since Pixelfed supports LDAP.
But I could not manage to make the LDAP work, so I went instead with a public instance that has ActivityPub disabled and all posts set to “Followers Only”.
People could also set each of their accounts to “Private”, but the follow requests were not working when I first set up the instance.