I didn't see this anywhere in the Hijack menu if it's built-in?

To access the Hijack web interface without CharcoalGray's stuff, use this URL:
http://empeg_address/?fid=101&ext=.html

To prevent users from chaning things on the player, you do not use the Hijack menu, you use config.ini. Complete details of all the config.ini options are in the Hijack section of the FAQ.

You might want to start with options similar to this, and look through the FAQ for more:

[hijack]
disable_emplode=1
max_connections=????
kftpd_control_port=0
khttpd_port=80
khttpd_dirs=0
khttpd_commands=0