Which policy type blocks remote TLOCs while allowing data-center TLOCs to form hub-and-spoke peering?

A centralized control policy is correct because it operates on the control plane (OSPF, BGP, OMP routes) and can influence how TLOCs are advertised and preferred across the entire SD-WAN fabric. By manipulating OMP routes, a centralized control policy can block remote TLOCs from being considered for spoke-to-spoke communication while allowing data center TLOCs to remain viable for hub-and-spoke peering. A centralized data policy operates on the data plane and influences how traffic flows, but not how TLOCs are formed or advertised. A localized control policy affects only the local device's routing table, not the entire fabric's TLOC advertisement. A localized data policy also operates on the data plane on a local device.