The UI is not involved at all with the federation aspect, so you could just expose the backend and not the frontend.
That won't stop anyone from using your instance however, the UI is just the UI, all the API calls go to the lemmy backend regardless. It'll still be completely useable through say, mobile apps which only care about the backend.
Technically you could only allow the webfinger and inbox endpoints available to the wide internet, but I suspect that'll be a bit fragile.