This is most likely a matter of configuring CPT registrations. register_post_type() has a lot of arguments related to visibility and access.
On top of my head to prevent CPT from having front-end links and queries you would want to set publicly_queryable to false.