Also it seems that rendering ACF forms on the front end will pull fields from JSON files irrespective of the private flag and sync status. I would expect the private flag to prevent that behaviour – does that make sense?
Ultimately some way to completely exclude certain groups from sync would be useful.