Hi there...
How can I stop listing Entities on empty URL or using the $model Parameter?
The server may not deliver any metadata infos to "everybody"...
Have you tried to use EntitySetPermissions?
https://download.tmssoftware.com/business/xdata/doc/web/entity_sets_permissions.html