You limit the hotel licenses. You then go hard on hotel inspections and revoke licenses or don't renew it from hotels that aren't up to code/standard. That way the available hotel rooms will go down. The number of licenses is limited by hotel category. That way you ensure a healthy mix of available room types and can still have all kinds of tourists in town. There won't be an issue with "big chains snatching up all the licenses".

Then for a time only people with a valid reservation are allowed to enter. You place checkpoints at the most common points of entry. That way you limit the number of potential tourists by limiting the available hotel rooms. It would also fix the issue of unregistered AirBnBs. It won't be perfect but you don't want to kill tourism just reduce it.

Locals and family of locals would be exempted from the limit. You just put some system in place to apply for that exemption for family. Since the checkpoints are only temporary (maybe around 6 months) the impact on locals and their family isn't too bad before it goes back to normal.

There will be a lot of media coverage about the closure and fewer tourists will come. The lifting of the checkpoints will barely make the news so things won't go back to how it was before. And the limit on hotel licenses is still in place, so the available rooms are limited anyhow. Naturally reducing tourism because fewer peope can book a room.