I am extremely late to the discussion, however the work around I found that worked with Bookstack was to set the Youtube video to unlisted. Then generate embed code, and use.

Then go into Youtube and set video to Private. My embedded video still works, however if the user tries to copy URL and play it outside of my Bookstack Youtube says the video is Private.