Limiting Access to Internal Services on USG 40

I have been perusing my new USG 40 and had a question about limiting access to some of the internal services, in this case FTP. Is it better form to block access from the zones I want to on the "System / FTP / Service Control" menu area or by adding / modifying a firewall rule? Thanks!