If you upload your game to the arcade, there are three access settings:
Public - Anyone can view it
Private - Only usernames you specify can view it
Private URL - Only playable if you know the exact URL
This should be sufficient. Your game might be deleted if you add a password layer, as that will clutter the arcade up and ruin the experience for most users.