There is a permission as to who can view member lists which would prevent users from seeing the list of online members, so that may be useful.
Also in the template forum_list, to hide the stats from all but admins you can find this:
Spoiler
Code:
<!-- block: forum_stats -->
<div class="section">
<div class="secondaryContent statsList" id="boardStats">
<h3>{xen:phrase forum_statistics}</h3>
<div class="pairsJustified">
<dl class="discussionCount"><dt>{xen:phrase discussions}:</dt>
<dd>{xen:number $boardTotals.discussions}</dd></dl>
<dl class="messageCount"><dt>{xen:phrase messages}:</dt>
<dd>{xen:number $boardTotals.messages}</dd></dl>
<dl class="memberCount"><dt>{xen:phrase members_count}:</dt>
<dd>{xen:number $boardTotals.users}</dd></dl>
<dl><dt>{xen:phrase latest_member}:</dt>
<dd><xen:username user="$boardTotals.latestUser" /></dd></dl>
<!-- slot: forum_stats_extra -->
</div>
</div>
</div>
<!-- end block: forum_stats -->
And replace it with:
Code:
<xen:if is="{$visitor.is_admin}">
<!-- block: forum_stats -->
<div class="section">
<div class="secondaryContent statsList" id="boardStats">
<h3>{xen:phrase forum_statistics}</h3>
<div class="pairsJustified">
<dl class="discussionCount"><dt>{xen:phrase discussions}:</dt>
<dd>{xen:number $boardTotals.discussions}</dd></dl>
<dl class="messageCount"><dt>{xen:phrase messages}:</dt>
<dd>{xen:number $boardTotals.messages}</dd></dl>
<dl class="memberCount"><dt>{xen:phrase members_count}:</dt>
<dd>{xen:number $boardTotals.users}</dd></dl>
<dl><dt>{xen:phrase latest_member}:</dt>
<dd><xen:username user="$boardTotals.latestUser" /></dd></dl>
<!-- slot: forum_stats_extra -->
</div>
</div>
</div>
<!-- end block: forum_stats -->
</xen:if>