Let's suppose I have a web server X, listening on port N for instance and configured as a Tor hidden service.
How and where is implemented its' hiddenness from public access?
Since you found my comment helpful, I'll just write it as an answer.
The concept is pretty simple. You bind your webserver to your localhost only, so it won't accept connections from outside your computer. Then you configure Tor to connect to this server. Since Tor is installed in your computer, it will be able to connect to your webserver, but others can't. This way, your webserver will only accept connections from inside the Tor network.
For more information, have a look at how to configure a Tor hidden service.
Servers configured to receive inbound connections through Tor are called hidden services. Rather than revealing a server's IP address (and thus its network location), a hidden service is accessed through its onion address. The Tor network understands these addresses and can route data to and from hidden services, even those hosted behind firewalls or network address translators (NAT), while preserving the anonymity of both parties.
Because hidden services do not use exit nodes, they are not subject to exit node eavesdropping. There are, however, security issues involving Tor hidden services. For example, services that are reachable through Tor hidden services and the public Internet are susceptible to correlation attacks and thus not perfectly hidden. Other pitfalls include misconfigured services (e.g. identifying information included by default in web server error responses), uptime and downtime statistics, intersection attacks, and user error.
Other relevant links.