An enterprise wants to prevent unwanted website access and block insecure ports at the network perimeter using a dedicated device rather than configuring each host individually. Which technical control category and implementation approach best fits this requirement based on the NDE technical controls module?