Since build 5.2.500 the ability was added to restrict access to various HTTP interfaces with the following parameter
http_enable_paths=rest,action,admin,shared,client,client_records,embed_player,empty
By default, all the HTTP interfaces listed in this setting are accessible. To restrict access to web interface but allow access to Ember Player, REST API and server statistics this parameter should be changed as follows
http_enable_paths=rest,action,shared,embed_player,empty