If there is no need to mount directories and file systems to Windows systems, then smb service can be disabled to reduce the potential attack surface.