Use Cisco ip helper-address deliberately: verify the default UDP broadcasts it forwards, keep DHCP working, and restrict only the protocols your topology does not need.