I have a bunch of different kits for bots and other stuff. They are hidden from the menu but players have been guessing the kit names and just type /kit name and are getting kits. Can you add an option that players without admin perms can only redeem kits through the /kit gui/menu

You  make the bot kits npcOnly with the permission "kits.npconly" then it doesnt matter if they guess it or no , they would not have the permission .
what ever the "other stuff" is you do the same for that, create a permission and only those who have the permission can redeem it,
ITS ALL IN THE DOCUMENTATION.