How to correctly close access to default backend in haproxy

[fo511]

Hello.
My haproxy ingress is published in internet.
For services and ingresses that are explicitly defined I'm able to limit access by IP/request path etc...
But default backend is opened without limitation.
So everyone can just query my IP without hostname and request non-existennt files or try to test exploits.
I tried to add strict_sni option to global object like that

    runtime_apis: 
      - strict_sni: true
        address: "0.0.0.0:8443"
        name: https

I expect that option will be added to default https frontend actually it was added to stats frontend.
I also cannot find a way to add backend-config-snippet to default backend so I would be able to define custon deny rules inside.

So question is how to correcly protect default backend from unlegitimate requests?