You could take advantage of the phases
feature that makes this sort of workflow quite easy.
https://www.mercurial-scm.org/wiki/Phases
When you make a branch/bookmark/commit phase secret
it's not pushed unless you explicitly do so. It's a great way to flag work that's not yet ready to share.