If you used an event wrapper (kind 20), then the visibility would be controlled by the event's location. If you put it on a public relay, everyone would see it on the app. If you put in on a private relay, it would be semi-private (the media is public, but the event is private). Semi-private is obscure and off-Nostr, but not completely hidden.
Discussion
When you want content to be private you use encryption.
Well, yeah, but you can encrypt the content separately. Don't need Nostr for that.
This is more about selecting what gets displayed in Nostr apps and how/where.
Encrypt the Nostr event to the people that should see it. Better solution than relays
You could also optionally make the events expire. Add an expiration tag for 60 days, or 1 year, or whatever.
Then they'd still be in your media server, as image files, but your app albums wouldn't contain old stuff.