How to stop others from adding cycles to my IC canister (except controllers and assigned users)?

Ah looks like you’re right, found this post that mentions it Question about deposit_cycles

anyone can call deposit_cycles. wallet_receive does not exist to work around a limitation of deposit_cycles, but rather because when it was created, deposit_cycles did not exist