As per recommended best practice, one of our secondary servers is in a different data center. However, when enabling slaveOK for a replication set, this server is sometimes read from, even though it's much slower than the secondaries in the same data center.

We have already set the priority to 0 so that this server never becomes master, but there does not appear to be a way to make that server unreadable by application code. I believe this is a core server issue since the configuration should be set in the replication set configuration and not in each client we want to use.