You are correct, you can simply leave the 'withdraw' function disabled, and then there is noway for a hacker to gain access to your funds. That coupled with whitelisting your ip and whitelisting withdraw addresses is the way to maximize your security....i have just learnt all this actually, made a video about it. https://steemit.com/bitcoin/@cryptoiskey/bittrex-how-to-make-sure-your-bittrex-account-is-secured-as-much-as-possible