Appengine / restrict services to only be available under a single domain
There is no way of hiding all the routes of the .appspot domain. As you probably are aware the dispatch.yaml, only works as a redirect. Probably, you cannot just disable the default domain, since there are a lot of tools like Cloud Tasks, Cron Jobs etc.. that uses that default domain, hitting those endopoints.
As for the second question, you cannot hide them, but in case you don't need them, you can overwrite them in the dispatch.yaml to point to some custom made "not found" page.
Having multiple languages to deploy under appengine; I wonder if some kind of private approach could be applied; in order to have it all resides only under a single domain
For example, given xyz.com domain setup as wildcard; having a default service, services svc1 and svc2; and a dispatch.yaml mapping */svc1/* to svc1 service and */svc2* to svc2 service; how to :

hide all the *.appspot domain ?
hide the automatic setup of svc1.xyz.com and    svc2.xyz.com ?

It could be easy for a given service to check the host and redirect to the desired one; but it would have to be done for every services; feels like there a better way
It feels a bit messy to have all those auto enopoints opened and unused, the idea would be to have it all under xyz.com/

-