All but the very earliest releases of errai-navigation allow you to initiate a new navigation event (with Navigation.goTo(), Transition.go(), or TransitionAnchor.click()) from within a @PageShowing method. If you do this, the original navigation event is pre-empted and will not appear in the browser’s location history.
Additionally, Max Barkley has done some more work recently on a declarative security system that works with Errai Navigation. The API isn’t 100% locked down yet, but your feedback would be valuable! Maybe Max could follow up on this thread with a pointer to something you could experiment with to see if it will meet your particular security needs.
We've recently been putting a lot of work into our Errai Security module, which provides declarative annotations that can restrict page access based on whether a user is authenticated with the correct "roles". It's currently available in 3.0-SNAPSHOT. You can check out the Errai Security Demo to see it in action. The demo uses Picketlink on the server, but using a different back-end only requires implementing a single interface.
If there's anything you feel Errai Security is missing for your use case, I would really appreciate your feedback.