Currently koji doesn't have any read access controls, or at least not any related to builds. Most folks would probably either use a private koji, or just run mock against koji's yum repos.
Are we really only talking about a scratch build type scenario, or do folks want a real build that is hidden? Difference being that in the former case, you'd end up running a non-scratch rebuild after the embargo lifts, while in the latter you'd flip a switch and have the build appear.
The latter case is much harder (and also begs for embargo lockdown in source control), but neither is trivial to implement.