An engineer connects an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router over an IPsec VTI tunnel. The on-premises site runs OSPF internally, while eBGP is used across the tunnel to advertise routes to the cloud. After enabling redistribution of OSPF into BGP and BGP into OSPF, the on-premises router begins learning some of its own local subnets back through BGP, creating suboptimal paths and intermittent routing loops. Which action best prevents these routes from being re-learned while preserving legitimate route exchange?