Confirming the workaround of blocking TCP ports 8008 and 8009, which I did with firewalld instead. Not ideal though.