The accepted answer by @steve-besch works but is incomplete. As explained below, to me the best approach appears to be patching gtk and and optionally libcups2 in addition to disabling cupsd-browsed.
1. Disable cupsd-browsed as already described
sudo systemctl stop cups-browsed
sudo systemctl disable cups-browsed
You can verify that this works using the printing configuration utility system-config-printer.
2. Patch Gtk such that its print-dialog no longer uses avahi
Create patch print_dialog_without_avahi_discovered_printers.patch:
--- a/modules/printbackends/cups/gtkprintbackendcups.c
+++ b/modules/printbackends/cups/gtkprintbackendcups.c
@@ -4008,7 +4008,7 @@
g_source_set_name_by_id (cups_backend->list_printers_poll, "[gtk+] cups_request_printer_list");
}
}
Reinstall gtk with the applied patch:
sudo apt build-dep libgtk-3-dev
apt source libgtk-3-dev
cd $(find gtk* -maxdepth 0 -type d)
git apply --reject --whitespace=fix ../print_dialog_without_avahi_discovered_printers.patch
debuild -b -us -uc --no-pre-clean
cd ..
sudo apt install --reinstall ./libgtk-3-0_*.deb
# do not update (dist-upgrade)
# sudo apt-mark hold libgtk-3-0
Now launch a new Evince PDF Viewer instance and verify that only printers listed in the system-config-printer app show up in the print dialog.
3. Patch libcups2 such that KDE/Libreoffice print dialogs no longer use avahi
Create patch no_discovered_printers.patch:
--- a/cups/dest.c
+++ b/cups/dest.c
@@ -1689,7 +1689,7 @@
data.num_dests = 0;
data.dests = NULL;
- if (!httpAddrLocalhost(httpGetAddress(http)))
- if (1 || !httpAddrLocalhost(httpGetAddress(http)))
{
/*
- When talking to a remote cupsd, just enumerate printers on the remote
Reinstall libcups2 with the applied patch:
sudo apt build-dep libcups2
apt source libcups2
cd $(find cups-* -maxdepth 0 -type d)
git apply --reject --whitespace=fix ../no_discovered_printers.patch
debuild -b -us -uc --no-pre-clean
cd ..
sudo apt install --reinstall ./libcups2_*_amd64.deb
# do not update (dist-upgrade)
# sudo apt-mark hold libcups2
Now launch a new Okular instance and verify that only printers listed in the system-config-printer app show up in the print dialog.
Background
As several answers here point out, printers that were not installed still appear in the print dialog of e.g. the PDF-Viewer Evince or Libreoffice even after having disabled the cups-browsed service. This could be prevented, by stopping the avahi daemon that actually finds these printers in the network: sudo service avahi-daemon stop. However, I strongly advise against this -- for instance it breaks Gnome's scanning app such that it is no longer able to scan and I expect other apps to break as well. Unfortunately, there appears to be no official way to disable only cups filtering in avahi (s. here). Instead, it was suggested to disable this on the level of the printing dialog. S. also here.