How to set macOS Server to prevent DNS zone transfer?
Preface: the file /Applications/Server.app/Contents/ServerRoot/private/etc/named.conf mentioned in your question is not the config file used by the macOS server. Instead the file is located at /Library/Server/named/named.conf.

The file in ServerRoot is the more or less empty default named.conf file. At the initial configuration while launching Server.app for the first time the ServerRoot named.conf is copied to /Library/Server/named/.



Access permissions to various features of the DNS server is determined by ACLs. The pre-connfigured acl in macOS server is com.apple.ServerAdmin.DNS.public.

Depending on your settings in the main panel of DNS the ACL com.apple.ServerAdmin.DNS.public is populated with networks:


If lookups are preformed for all clients:



the respective ACL in named.conf looks like this:

acl "com.apple.ServerAdmin.DNS.public" {
    any;
};

If lookups are preformed for some clients (example only):



the respective ACL in named.conf looks like this:

acl "com.apple.ServerAdmin.DNS.public" {
    172.16.0.0/16;
    localhost;
    localnets;
};


The only ACL available in named.conf after the initial set-up is com.apple.ServerAdmin.DNS.public.


This ACL by default allows lookups in the view section for all member networks:

view "com.apple.ServerAdmin.DNS.public" { ⬅︎
    zone "localhost" IN {
        type master;
        file "localhost.zone";
        allow-update {
            none;
        };
    };


and also allows zone transfers in the view > zone [zone_name⁣] > allow-transfers section for all member networks.

...
    zone "test.home" IN {
        type master;
        file "db.test.home";
        allow-transfer {                      ⬅︎
            com.apple.ServerAdmin.DNS.public; ⬅︎
        };
        allow-update {
        none;
        };
...


To separate lookup clients from zone-transfers clients (AKA slaves) simply create a new ACL "slaves" (example):

acl "com.apple.ServerAdmin.DNS.public" {
    172.16.0.0/16;
    localhost;
    localnets;
};
acl "slaves" {
    172.16.1.8/32;  #first DNS slave
    172.16.1.18/32; #second DNS slave
};


To restrict a zone-transfer for a particular zone to slaves only, modify the allow-transfer directive ACL to slaves:

...
    zone "test.home" IN {
        type master;
        file "db.test.home";
        allow-transfer {       ⬅︎
            slaves;            ⬅︎
        };
        allow-update {
        none;
        };
...


Don't include the arrows accidentally and relaunch the DNS service afterwards!



A more advanced &amp; secure approach is to use shared secrets/keys which is explained here: Using TSIG to enable secure Zone Transfers between Bind 9.x servers. I didn't get this to work in Sierra though.



To check whether zone transfers are possible to arbitrary hosts use on the (attacking) client:

dig @dns_server_ip example.org axfr