Last time i tried a controller with GES, i was still able to use Mouse+Keyboard.
So even if there's a way to detect the presence of a controller, i don't think it's possible to make absolutly sure the client is using it.
So the only possibility remains: get some friends together you can trust that they'll be using a controller and host your own password protected server.