How can I hide generic types behind a project library in .net core solutions?

For starters I have four projects which all use .NET Core projects. I have a web project, an Entity Framework project, a DTO project containing some POCOs, and a service layer between the web and the data project.

I don't want my web project to have direct access to the data layer. Instead, I use the service layer to pass the DTO objects over to the web application.

I have a generic type Serivce within my service project swhich accepts the type of EF entity.

The service classes are implemented like this:

public class CompanyService : Service<Company> { ... } 

Next, my web web uses AspNetCore and consumes the services through the DI container as needed.

public class HomeController 
{
    public HomeController(CompanyService companyService) { ... } 
    ... 
}

The problem I am facing is that when I reference the service project my code has direct access to the data layer which I have not referenced from the website project.

As you can see the reference to the services has included the reference to the assets it uses within that project. Meta-Packages is a feature which causes the child referenced to be bundled with the services. The problem is these bundled references break my code separation. A user can just new up an instance of database within the HomeController and bypass the services provided altogether.

Now, I read that you can use PrivateAssets="All" on the package reference in the project file. However, this prevents the service class from being used altogether.

<ProjectReference Include="PointBlankSolutions.Data.csproj" PrivateAssets="All" />

I receive the following error:

Severity    Code    Description Project File    Line

Error CS0012 The type 'Database' is defined in an assembly that is not referenced. You must add a reference to assembly 'PointBlankSolutions.Data, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' "App\Startup.cs 29

I don't understand why the data application needs to be part of the website if nothing from that project is exposed to the web application.