Are you using IPv6 on your management interface? If not, I would recommend blocking it upstream. IP spoofing is based on the routing table, so you would need to have a route for the IPv6 traffic out the MGT interface.
All traffic to the MGT interface goes directly to the CPU.