We need a setting to globally enable/disable unlisted events and an acl setting (both are supported by SettingsProxy) to specify who can create such events. Since there is no "Everyone" acl entry, I would propose two settings, one ACL to allow specific users/groups to crate unlisted events, and one toggle that allows everyone to do so (in that case the ACL would not be taken into account).
Not sure what's the best place to put it in the admin area; initially we could just add it to the "General Settings"...