I found a simpler solution to the one I just posted:
No need to move the farm's pub/ directory.
Just place an .htaccess file with
     Order Deny, Allow
     Deny from All
into the farm's root directory,
and put another .htaccess file with
    Allow from All
into the farm's pub/ directory.
Best, 
~Hans