I have looked but cannot find a setting that will do this, if it exists I apologize and would appreciate being pointed to it.

Within a team, we would like an option to either have new repos be private by default, or enforce a "private only" setting to make it impossible for someone to create a new public repo or make an existing repo public.

I understand the second option (no public repos possible for a team) might be a rare edge case. But I think having an option to create new repos as private by default would be useful for many teams.