LevelBlue advises blocking the device code authentication method globally in Conditional Access Policies to prevent device code phishing. If the flow is required for specific use cases, those resources should be explicitly excluded and continuously audited.