We have DBAs who want to access SQL DBs over DirectAccess (DA). The ask is to open port TCP 1530 over DA. At the moment, we have 6,000 people using DA, we can't filter on a specific group of DBAs. Effectively if we open the DA rules to all clients, that's 6000 individuals with access to the DBs (TCP 1530).
What's the best practice approach? Preferentially backed with official vendor/body preferences.