A service provider runs an MPLS L3VPN. A PE router imports routes into VRF CUSTOMER-A using route-target import 65000:100. The network team notices that a specific set of customer prefixes tagged with an additional extended community must be prevented from entering the VRF even though they carry RT 65000:100. Which mechanism should be applied on the PE to selectively block those prefixes while continuing to import all other 65000:100 routes?