A service provider operates an IOS XR PE router that establishes a multihop eBGP session with a customer's router located two Layer 3 hops away. The security team wants to ensure that spoofed BGP packets originating from remote parts of the internet cannot reach and attack the BGP process on the PE, while still permitting the legitimate two-hop peer. Which control plane protection mechanism should be configured on the eBGP neighbor to meet this requirement most effectively?