How to block anonymous access with Data Security Policies

[Jeff Hoover]

I stumbled across the new "Data Security Policies" feature listed under Security > Data Protection.  The What is a data security policy article shows the ability to prevent anonymous access to Confluence in an example policy.  When setting up a new policy, the only option I can find is to allow or block page exports.  Has anyone figured out how to restrict anonymous access?  The article also mentions the ability to block app access to data, but I don't see that either.