[FEATURE REQUEST] Let minions only see its configuration on master

Is your feature request related to a problem? Please describe.
I want to disable the cp module on all minions. Users might get root access on our nodes and we don't want them to see all files on the master. Listing the files that are applied to the minion is OK, but everything else should be hidden. There doesn't seem to be a config option to do this.
I can only disable modules, but this needs to be configured on the minion itself - so any user could overwrite this. So, it would be great if this could be configured on the master.

Describe the solution you'd like
A master config options to let minions only ever see the files that are applied to it.
Also, a master config option to disable modules on minions would be great.

Additional context
Is there any way to restrict on the master what a node can see? I handle my secrets in pillars, but it's still not great that all minions can see how I configure every machine I have.
I use git branches as environments to ease development, so using environments to hide files is also not possible (or is there a way to specify the git branch and environment in that git branch?)

Thanks for reading :)