Load Balanced maintenance_mode = 1

I have a customer with an Piwik environment configured for high traffic sites. I have configured 3 “trackers” in a load balanced environment and would like segregate the trackers from the UI. I would like to create an additional set of load balanced servers for UI functionality on an internal network only available via VPN.

The trackers obviously need to be “exposed” so they can collect data, but I would like to disable the UI on them. If a malicious user manages to navigate to one of the tracker URLs, I don’t want them presented with a login. Also, I would prefer if the UI API functions be disabled on the trackers so a brute force attack on piwik cannot occur.

Few questions:

Can I use a different config,ini.php for the UI and trackers?
if not,
How can I put the trackers in “maintenance mode” and leave the UIs accessible?

If the trackers are in maintenance mode with this disable UI API calls and leave tracking functioning?

Thanks for any input…