There's not much reason to secure internal services that do not publish any ports. Such services are usually intended to be accessed by other services that are attached to the same internal network. For example, the go-demo stack deploys two services. One of them is the db service that can be accessed only by the other service from the stack (main). We accomplished that by having both services attached to the same network and by not publishing any ports.
The main objective should be to secure communication between clients outside your cluster and services residing inside. We usually accomplish that by adding SSL certificates to a proxy and, potentially, disabling HTTP communication. Docker Flow Proxy makes that an easy task. If you haven't set up your SSL, you might want to explore Configuring SSL Certificates (http://proxy.dockerflow.com/certs/) tutorial...
