Hi… Last I heard, there is no way to make some services Flycast-only but leave others open to the public, 
:
More broadly, a Flycast-only app is just one without any public IP addresses assigned; I typically launch/deploy with --no-public-ips to be extra sure. (And it looks like there is a newer --flycast flag out as well, now.)
Any unwanted public addresses can be retroactively removed via fly ips release, as you may already know.
Traditionally, Fly.io splits responsibility across imperative flyctl calls, fly.toml, etc., and there isn’t an all-inclusive declarative configuration. That may be changing a little as work on GitHub-based launches continues. We’ll see.
Hope this helps a little!