Closing down outside management

Create an internal VLAN that is only accessible within your organization, configure the Management Port with an IP address in this VLAN. Platform >> Configuration >> Management Port.

I have the management NIC on a private network that can only be accessed by VPN, but what do you do about the outside address? Can you just remove it?

each self-IP address has "port lockdown" which allows you to "allow none" in regards to connections directly to the self-IP