I use tags. For example, anything with a server tag can accept ingress ssh connections but not egress.