While I don't have it set this way yet, I plan on setting my Do-Not-Pass list to "White-List" mode (meaning the list of keys are the _only_ ones to pass. And all I'll include are 1-9, 0, -, = and the Ctrl and Alt versions of those keys as well. That's it.

It's not a perfect solution but it'll help you deal with the inital problems of clones going wild when you do anything abnormal. Eventually you might unlock other keys to pass thru. But for now, those are a good initial set of keys to allow.