A storage administrator has correctly configured single-initiator zoning on a Cisco MDS 9000 fabric so that a specific server HBA can reach a storage array's target port. However, the security team is concerned that the server can still see and potentially access LUNs belonging to other servers presented by that same array target port. Which additional control most directly restricts which specific LUNs behind the target port that particular server is permitted to access?