A team opens SQL access to every internet address for convenience. What is the safer production design?

1. Remove all routing and expect SQL credentials to provide connectivity.
2. Allow all ports because TDE encrypts data at rest.
3. Permit only required application and administration paths using the supported private network controls.
4. Share the administrator wallet publicly so clients need fewer rules.