Well at some point one can never know things for sure. BUT, not running it on the device you want to filter would be a good step. And default deny.

Security is a matter of layers, there is not one layer that fixes all.