deny smb, allow domaincontroller

[mfourtwenty]

Hi,
we would like to disable the possibility for users to use the SMB shares, but they should still be ablte to use the domaincrontroller feature (which also needs samba to run correctly).
due to the fact that there was a misconfiguration i the folder aggregation, we are not able to disable the smb at all and have to keep this service running to prevent data loss.

we saw that there is a possibility to prevent available services on several interfaces, but we didnt find any description to the listed services - which service will be used for the DC feature?
and does the DC still works after we denied SMB on the specific interface?

BR
Michael