This explains how to categorise a course as confidential so that it can't be viewed by anyone other that System Admin permission levels and is not visible when using the QR Code.