This is the only way. Just deny by default.

I never liked Postman and that's how I mostly stopped using it. Completely stops working on analytics request denial and then starts sending reports to Sentry (but even if you allow those, they don't learn, I've tried)