JS Revealing module pattern: Params that shouldn't be used by usercode

I have a module written structured with the revealing module pattern. This contains a sub-module that kind of works as an overload. A few functions of the main module have parameters that shouldn't be used with usercode - only via the submodule. How can I access the params from the submodule but make them unavailable for "external usercode"? Should I make another layer for this?

var someNamespace = someNamespace || {};

someNamespace.someModule = (function () {

    // _customSiteUrl, _customToken shouldn't be available via usercode
    function create(listName, data, _customSiteUrl, _customToken) {
        ...
    }
    var XS = (function () {
        return {
            createXS: function (siteUrl, listName, data) {
                ...
                create(listName, data, siteUrl, token);
            }
        }
    })();

    return {
        create: create,
        XS: XS,
        ...
    }
})();

someNamespace.someModule.create("hi", {}, "https://...", "someHash"); //Should not be possible!!
someNamespace.someModule.create("hi", {}); //Should be used