Separate inbound routes will work fine if you have a small number of CIDs you want to treat differently. If that becomes unmanageable, you can use something like the whitelist I’ve described here: