The Guidance column of PCI DSS 1.3.3 (v3) states:
Examination of all inbound and outbound connections allows for
inspection and restriction of traffic based on the source and/or
destination address, as well as inspection and blocking of unwanted
content, thus preventing unfiltered access between untrusted and
trusted environments. This helps prevent, for example, malicious
individuals from sending data they've obtained from within your
network out to an external untrusted server in an untrusted network.
This means firewall controls and content controls (IDS/IPS, WAF, DLP proxies) should be used to limit CDE ingress/egress. Permitting traffic in to limited, necessary ports is okay. Permitting broad traffic in to unnecessary ports is not okay. Permitting unregulated outbound traffic which could allow an attacker to exfiltrate data is not okay.
It really boils down to "preventing unfiltered access between untrusted and trusted environments." I'll grant you the wording isn't directly useful.
(There is no guidance column in PCI DSS v2, but the requirement itself is the same, and the whole point of adding a guidance column with v3 was to provide, um, guidance to clarify the intent of the requirements. So it's valid whichever version you're working with.)