which would be the most efficent place to configure LUN masking?

To prevent non-ESXi hosts from seeing VMFS datastores, which would be the most efficent place to configure LUN masking?

A.
on the ESXi host

B.
on the SAN Storage Device

C.
on the non-ESXi hosts

D.
on the Fibre Channel Switch