I’m afraid making your instance private disables federation.
As for making the web interface private, while it would prevent the average Joe from seeing federated communities, you could still do it through the API, which you have to keep public if you want to use alternative and mobile clients without a VPN.