You could set up a login system on the website. They won't get access to the bot unless they are logged in