If you use ezmlm-get(1), archive retrieval can be restricted by using the ezmlm-make(1) -g (guard archive) switch. This in turn sets ezmlm-get(1) up with its -s switch, allowing access only to addresses that are subscribers of the list, or of the digest list, or that are present in an extra address database stored in DIR/allow/. Addresses can be added remotely by mailing ‘list-allow-useralias=userhost@listhost’. Other commands, such as ‘subscribe’ work as expected. As you can see, the different programs have many options and ezmlm-make(1) organizes most of them into the most useful sets to make it easier. Don't hesitate to look at the ezmlmrc(5) man page and man pages for individual commands. There are many useful options to more finely tune your lists to your taste. Via modification of ezmlmrc(5) you can make your favorite options the default!
Since ezmlm-get always sends the reply to SENDER, this assures that only subscribers can get archive excerpts. Since SENDER is easily faked, anyone can still request archive info (and drain system resources), but replies go only to subscriber email addresses. The DIR/allow/ database can be used to manually add addresses that should be given archive access, but are not subscribers. This may be an address of a subscriber who posts from an address other than his or her subscription address.