For suggest some rules , is needed to know at least the network topology and what you wish allow/deny to the cp clients (eg. only some services/ports , management of other devices beyond Zs server , apply time-based rule for specific services…)
cheers jonatha