Actually… yes.
- Publish your site in its public state, on your custom domain.
- Then uncheck the publish checkbox in front of the custom domain, only leaving the one in front of the .io that you’ll use as a staging.
- set up the password on the site
- publish (to .io)
You now have a protected .io staging and an open site on custom domain. Don’t forget to unset the password next time you push your changes to production (custom domain).