On server side:
seta sv_maxclients "32" //max
seta sv_privateclients "2"
seta sv_privatepassword "9U-64dsefA"
//public slots 30 (32-2)
On client side:
Via the console if the server not passworded (g_password is ""):
/connect address
ort; password 9U-64dsefA
Or via main menu when the password popup appears and instead of typing the g_password to auth as public client, you type the private one.