Kudos to @galaxis. There is an option to disable timelines for non-authenticated users, which also disables remote hashtag access.

Bots are still scraping media, but I hope when queue dries up it will stop as well

#fediadmin #mastoadmin #mastodon