So this thread has morphed from trying to enforce HTTPS-ONLY into a primer on CUPS configuration -- for which I'm grateful.

I've decided to go with Mode-1 as described above because, that mode uses the CUPS client.conf to point to the remote CUPS server and allows me to eliminate the localhost server entirely - obviating the need to control HTTP access by eliminating the server entirely. Without a system restart, I also added:

to the above commands.

With regards to Mode-2 above, that's where I started. In Mode-2, Ubuntu's Settings > Devices > Printers dialog provides a "live" Add Printers button. However, despite the fact that cups-browsed does apparently identify the remote printer, every attempt to add it resulted either in the alert "Add new printer failed" or in the localhost CUPS server reporting "Filter Failed" when any attempt was made to print. I eventually discovered how to point the local CUPS client to the remote server (i.e. Mode-1) which added the printer and successfully prints to it as described earlier in this thread.

Since the Mode-1 implementation does eliminate the undesired HTTP access by virtue of eliminating the localhost server entirely, I'm going to mark this thread SOLVED. I will leave the issue (?) associated with Ubuntu's un-intuitive method of adding a remote CUPS printer via Mode-2 for another thread at another time.

Thanks again phild.g for your help.