Post/Custom Post Type URL Access

If you don’t expose the permalinks on the front end, then there’s no way for someone to reach them, but if you want to absolutely prevent it then set publicly_queryable to false when you register your post type.