According to documentation and staff comments on this forum;
Setting API Product Access to internal or private should prevent it being self registered in Developer Portal. That is not working, regardless of what the Access of Product is, all of the products are allowed to be selected and self registered to App in Portal.