which would be the most efficient place to configure LUN masking?

To prevent non-ESXi hosts from seeing VMFS datastores, which would be the most efficient place
to configure LUN masking?

A.
On the ESXi host

B.
On the SAN Storage Device

C.
On the non-ESXi hosts

D.
On the Fibre Channel Switch