XF 1.4 Member list permissions

I'm sorry if I'm repeating a question, but I tried to search on this and keep coming up with old info.

I do not want my unregistered or registered users to see who is online (neither in the 'who is on-line now', nor in the members list), except for staff. I thought that was possible without an add-on in 1.4, but I cannot find the option. Or maybe I do need an add-on, but I'm not sure which one.
Oh, and I cannot control who is seen? I want my unregistered users and registered guests to see the staff, just not the whole list. Does an add-on accomplish more control over this?