The only additional security you could implement at a router level would be to restrict the mac addresses that DLSW will pass traffic for using an access list 700 - 799 and the dmac-output-list parameter on the dlsw remote-peer statement.
Since this uses the destination mac address, you would need to code it with the controller mac address in the router on the FEP side of the connection. It would not prevent any controller from sending an initial test frame but traffic will only be returned to specific mac addresses.
