register_post_type() has quite a few related arguments, of which publicly_queryable controls precisely what you are describing.
However note that it will completely kill the CPT on front end — individual posts, archives, even post previews.
If you want to do this conditionally you’ll have to manage this with code from scratch, which might get very involved to do comprehensively.