Create the stream as follows (assuming multichain-cli on Linux):
create stream [stream-name] '{"restrict":"onchain", "salted":true}'
This will ensure all data is published off-chain, and that every hash is salted. If you also want to make the stream write-restricted, substitute this in the appropriate place:
"restrict":"onchain,write"