How can I protect Single User Mode to require a password?
You can add a firmware password, which will need to be entered before the Mac can be booted into Single User Mode (or from external media). Boot with ⌘R to enter Recovery, then select Firmware Password Utility from the Utilities menu to set it up.