How to hide INSTANCE-ID' in WMS requests'

The limitations of OGC standard do actually not make it feasible to hide the instance ID.

What we suggest you do is to use Sentinel Hub API instead of OGC API:
https://docs.sentinel-hub.com/api/latest/#/data/Examples_for_S2L1C

This supports proper token based authentication so it is much more difficult to “steal” the connection.
For our enterprise customers we do even provide a secure handshake, so that you do not reveal any credentials. You can check how this is done on Sentinel Playground.