If you can make the private/secret tags primary tags it would probably be the easiest solution to the problem.
I don't think Flarum has a way to customize which discussions end up as the "last in tag" and no extensions I know of customize this behavior. The "last in tag" will always be the latest non-deleted discussion under that tag, no matter which users have access to it. If the tags are standalone, then the ability to view the tag should be the same as the ability to see the discussion, and there is no leak of information.
A quick "workaround" would be to create a local extender that modifies the tag serializer and makes it so the last discussion relationship is never returned, either for all tags or for a specific tag.