It isn't possible to disassociate the public IP, AFAIK. You can, however, hide instances behind a firewall by adding a private IP to each instance and then configuring everything except the firewall to drop packets sent to the public IP. In Linux, the latter could be done with "iptables -A INPUT -i eth0 -j DROP" (assuming eth0 corresponds to the public IP).