Don’t change the dovecot conf, because then it probably wouldnt survive an update.
Either block it at firewall level if you have one in front of mailcow.
Or configure the POP ports to something non-standard and hard to guess, e.g. 45223.
And additionaly - in Mailbox configuration - you can remove the right for users to access via POP.