Yes, it is possible. You need to restrict access to (transfer) and (transferfrom), with the help of this they will not be available to the general public. You can run the risk of tokens being locked unless you put the data storage to another contract. But you could not implement any transfer logic in these methods.