How to prohibit browsing with the default DVM template

I thought something like this?

[user@dom0 ~]$ qvm-tags my-dvm add template_for_dispvms

Then, to put in 30-user.policy

qubes.OpenInVM * @tag:template_for_dispvms @anyvm deny

At least looks more like Now You’re Thinking With Qubes