What I've figured out is somewhat of a hack, though it appears to work. I set the Default behavior to point to an Origin called Null. The Null origin points to null.mydomain.com which doesn't exist, thus any request will just error out. Then, I setup other behaviors for each directory in my website that I want to whitelist. It looks like this:
This appears to work, but is there a better, less hacky solution that I'm missing?