systemd knows three states for a service: enabled, disabled and masked. So far, the latter state doesn't seem to be supported by puppet's systemd service provider.
The difference of disabling and masking a service is as follows: a disabled service can be started as a dependency of another service or be started manually by a user. A masked service can neither.
Masking is done the same way as enabling or disabling:
systemctl enable|disable|mask <service>
So kindly implement either enable => mask(ed), ensure => masked (not sure what seems more logical) or mask(ed) => true|false in the systemd service provider.
Note: there's also a "unmask" command to systemctl. I figure ensure => enabled|disabled should always unmask the service additionally to enable|disable it.
severity: low (can use exec, etc, to work around)
test level: unit (tested in spec/unit/provider/service/systemd_spec.rb)