A service provider security engineer must harden the management plane of a Cisco IOS XE PE router. The requirement is to ensure that in-band management protocols such as SSH and SNMP can only be received on a single designated loopback-facing interface (GigabitEthernet0/0/3), while all other data-carrying interfaces silently reject management traffic destined to the router itself. Which feature directly satisfies this requirement?