There is a reason for the wording "All (recommended)". Just leave it at that. The firewall rules will prevent anyone from accessing your Unbound via WAN - unless you specifically allow that.