I agree, maybe removing the extension from the public facing web store is a better solution. But at the very least, allow the extension to be installed if you have the "hard to guess" URL. I do this with my app that requires a desktop app to be installed since it requires native app messaging.
If you really want to use the extension, you can clone the extension's repo, enable Developer Mode on the extensions page in Chrome, and then load the extension.
You can probably do this in under 30 seconds, but it's enough of a barrier to keep naive users from doing it.
