Restrict access to CiviCRM home
I would take a closer look at the event calendar extension and check which permission exactly it needs (something more specific like "CiviEvent: view event info" might work) - if that's not the case, I would file an issue with that extension as it's probably a bug. Ask the extension author to change the permission check to "CiviEvent: view event info".