Hey Sebastian,
it’s great that you make your thoughts about security when running UCS publicly available. To get more advise I would like to point you to these articles:
Regarding your concrete need: Unfortunately I expect that this is not possible as the path /univention stems from the directory /var/www/univention and is hardcoded in multiple places. (On a side note I am not that keen of security by obscurity although it can make sense in your case)
But there are some other things you can do: Best in my opinion would be to make UCS available via a reverse proxy so that you can prohibit access from outside to the UMC, ideally with internal access via VPN. If you want to hide that the server is running UCS at first glance it might already suffice to change the apache2/startsite.
Best regards
Jan-Luca