Define Access Control based on URL Path
What we ended up using was an existing module that we have already installed (Context) along with a custom block.

We created a new context for hidden sections of our site using the condition of the request path and the user role anonymous. From there our two reactions were to hide all sections within our theme except ones for help messages to our users, and to add a custom block to that help section.

Works like a charm and is fairly straightforward to change and keep track of in config.