A private service design must prevent clients from bypassing an approved proxy and reaching the backend directly. Which approach best fits?

1. Restrict direct backend access to the intended proxy path and identities.
2. Use network firewall policy for packet flows and service perimeters for the relevant managed-service boundary.
3. Plan explicit segmentation and narrowly scoped inter-tier firewall policy.
4. Choose and validate a supported encrypted connectivity topology.