Make the node Private (check Private Node at the top of the Node permissions page for that forum), which hides it from all users unless you explicitly assign rights, then assign rights to only the moderators and administrators groups. That's how my admin and mod forums are set up (I was actually just reviewing security on them recently).
There are two ways.
Ah. This bit was slightly confusing. So, I can assign mod and admin group permissions to the private forum and I do not need to do it for individual users? That is good.
But you can. I don't recommend it from a best practices standpoint because it means you could end up with surprises down the line. When I did my perms audit of the admin forum, I discovered that a former admin (who has now left the board completely) still had individual permissions on the forum. I don't think he could have accessed it easily since the parent node was correctly set up but it's the kind of thing that gets missed when you use individual perms.
