Mastodon's handling of so-called "private" posts is changing. Read the blog for the official line.
Realise that /at best/ distribution preferences are advisory-only, and are at the whim of whoever it is who chooses to follow you. /You don't get to set your own distribution./ Not without constantly checking and blocking followers you don't care to have, which I see as untenable.