Hi Dave,
Assuming that such block is added to the individual courses, you can override student and guests roles for your whole installation and set "View list of online users" to Prevent.
The users will then see this in the block: Last 5 minutes: 2 (no names will be listed).
You can also hide the block completely from studnets, but you will need to do it in every single course manually, by clicking Assign Roles icon in the block itself, overriding the student role, and setting View Block to Prevent.
Since users can manage to add the block to myModole page, I would probably set the capability to Prevent for everyone who is a guest or authenticated users. And then I would specifically allow Instructors only to see the list.