There is REST API handler (in form of UnregisterDeviceHandler.groovy script) which placed in /scripts/rest/push/ directory in Tigase XMPP Server installation directory will enable endpoint (documented in Development Guide) allowing client to disable their push notifications even without authentication to their XMPP server.
It is recommended to not expose this endpoint using HTTP but only with HTTPS.