Your company deploys an Azure Route Server in a hub VNet to exchange routes dynamically with two SD-WAN NVAs, each connected to a different on-premises branch via BGP. You notice that traffic from Branch A is being routed through Azure to reach Branch B, consuming hub bandwidth. Security policy requires branches to communicate only over their private WAN, never transiting Azure. What should you configure on the Azure Route Server to prevent this transit behavior?