Possible to block addons only for the server?

If you want to prevent leaks just follow this simple rule: never give anyone access.

People can still grab custom addons from custom made scripts.

if you mean lua stealing: thats impossible to prevent and cant give you serverside files

just be careful with your lua files and dont put important stuff in shared files.

Apart from that you could try to "backdoor" or "DRM" Clientside stuff but that is not really doable.