I assume you've figured this out already, but yes:

options.CheckPermissionAction = context => false;

will reject all attempts to access the error pages. As a more complete example, for the XmlFileErrorLog logger, omitting whatever else you normally configure:

services.AddElmah<XmlFileErrorLog>(options => {
    options.CheckPermissionAction = context => false;
});

Note that this rejects everything - if you still want to access the logs locally, you'd need to add some sort of "is local" or "is development" switch, but how that's done is more or less unique to your configuration.