There are a number of ways to limit access to your maps and data when using storymaps. The first is to limit access to your layers. There is some good documentation on this available here. This means that you can make your data public, but limit it's use to your specific organisation, or specific apps.
You can also create views of your data if you want to limit what features and attributes can be seen publically. See this blog post for the latest additions to this feature.
Finally, you can then disable the Save As option within your webmaps. All in all, your maps and data are pretty safe and secure!
There is also another option to secure your data even more. If you do not need popups, and the data is unlikely to change, then you could publish the data as a tile layer. Tile layers can be published directly from ArcGIS Pro/ArcMap/ArcGIS Online - see documentation here. The benefits of this are that the data is returned as images as opposed to JSON (i.e. text) so is more difficult to intercept and copy.