You can do either. Whitelist is obviously preferred.