A financial institution is deploying a new ONTAP 9.10 cluster for a latency-sensitive database application using NVMe/FC. The security team mandates that host initiators should only be able to discover and connect to specific, pre-assigned target ports on the ONTAP cluster. Which ONTAP SAN feature must be configured to enforce this policy?