All the following has been validated on MacOS Mojave 10.14.6
While there is a command line preference to accept only local VNC connections, that setting still doesn't prevent the daemon from listening to the wildcard address, and advertise the service on Bonjour. I haven't actually tried to see if it restricted anything in modern versions of the operating system, but here it is for reference:
sudo defaults write /Library/Preferences/com.apple.RemoteManagement.plist VNCOnlyLocalConnections -bool yes