Hi,
You usually have nothing to do.
Cortex-M4 is disabled by default (i.e. MCU is in HOLD_BOOT, i.e. Cortex-M4 core clocks are stopped), unless it is specifically started (see https://wiki.st.com/stm32mpu/wiki/How_to_start_the_coprocessor_from_the_bootloader)
Similar root clock gating is available for peripherals , i.e. if no related peripherals are assign to m4 in the device tree, their clock sources are not started by Linux. (See https://wiki.st.com/stm32mpu/wiki/How_to_assign_an_internal_peripheral_to_a_runtime_context)
Note that many peripherals, which could be assigned to Linux runtime context, reside on 'MCU side', so when Linux is running and those peripherals are active, the related buses could be active too.
There is no power switch able to remove the static leakage for the unused portion of the device (including Cortex-M4, memories, peripherals).
Regards,
Patrick