You can use a management ACL to deny everything except the OOB port. Page 1049 [URL]  
we want to limit management access only via the Out of Band interface, I am finding that you can do this via access profiles, is there an easy method of doing this? Thank you in advance! 
Method for prevention of in-band management / only allow out of band management