Hi Fused,
It's a reasonable request, and it's feasible, but hard. You have to choose the generator carefully, if you want the blades to behave the way you want.
Start with your choice of TSR. The smaller the TSR the slower the blades turn relative to the wind speed. Use a low enough TSR and you can do what you want - limit the RPM and save yourself the bother of a furling system.
But the thing you have to keep in balance is the generator. It's the load that keeps the blades from running away when the wind is strong, no matter what TSR you choose. So make sure you put on a generator that can handle all the power that the wind can throw at it. To make the calc's simple, take the sweep area of the blades, find the wind power at the disk. Use the fastest wind speed recorded for your location. From the wind power, multiply that by 59% for the Betz ratio efficiency, and multiply that by 50% again for the generator efficiency. If your generator can handle that power output continuously, from the strongest wind the turbine will face, then you don't have to worry about your generator having a meltdown.
With the generator spec's in hand, find the RPM where that power output happens. Use that RPM and the wind speed from your calc to get the TSR at max power. If that TSR is less than 1/2 of the TSR you selected for the blades, then they will probably stall out, and you've got your bomb-proof machine.
I'm on my 3rd wind turbine iteration and I've almost got this situation. My motor-conversion generators all seem to develop a current limit at high power, preventing the power taken out by the generator from rising as fast as it comes in through the blades, so I'm still happy to have a furling tail, but I know it's not necessary at the wind speed that it's set to act for.
The other watch-out is that wind power rises with wind speed cubed, and generator load rises with current squared. Don't pick a wind speed to design for that's too low or a stronger-than-average storm could overpower it.
From what I've seen (on this forum and elsewhere) the thing that kills the blades are damage leading to imbalance, and the thing that kills axial-flux alternators is the heat from electric current. If the blades alone fail, the alternator may survive, but if the alternator has a meltdown, the overspeed often destroys the blades. So making sure the alternator won't self-destruct when the wind is high is, to me, the most important job.
There is a penalty when you go down this road, and it's the risk of also having stall when the wind speed is low.