It kind of depends on whether or not you have any active instances.

Usually I just unpublish, but if you have active instances that still require user tasks to be completed, then I would change it to Restricted until all instances are completed.

Unpublishing won't remove any process data or submission history, but I'm 99% sure it would prevent users from completing user tasks so it depends on your process.

Submitter access rights only apply to the initial form, so even if you set it to Restricted and give no one access, that wouldn't negatively impact user tasks that happen after a process starts, meaning it is a good way to prevent new submissions without disrupting active processes.

I would not recommend just changing the URL because all that does is obscure the form meaning there's still a chance, however remote, that someone could find and submit the form.