Hi Greg,
We also have a couple of suggestions that we recommend before going the attribute route.
1. You can create a subset of the entity, excluding the fields that you don't want to send to the client.
2. Or you can create a secondary entity with the excluded fields and create a 1 to 1 relation with the main entity. This is such that when you query for the main entity, you have an option to exclude that secondary entity.
Hope this helps.