As a side note, you can change the subnet (CIDR) to only block a port for one host. For example you could block access to external port 3478 for just one ip (192.168.1.20/32). This may take you some time to test different scenarios, but I think it's probably possible.
Best of luck and post back if and when you figure it out!