You could also firewall off people from connecting to the DB server by blocking your active port for the instance out for everyone, then only punching a hole into the rule for those computers who need to query SQL directly.

Would mean you would have to set everyone who needs to query the DB up with a static IP address, don't want your DHCP address changing locking you out from accessing the server