Actually I am unsure if I understand what you mean by putting it in the filter, I see it that instead of setting/unsetting manually I would do it in a loop like so:
~~~
add_filter('thermal_user_entity', function($data, &$post, $state){
    unset($data['some_secret']);
    unset($data['anotehr']);
});
~~~

I think it might be better instead to write the meta into a temp object and then pick out the fields that are ok to show publicly that way is it a simple set statement.