I opened up port 443 for access to the Virtual Office module.
Unfortunately, this also made eGuide available to the outside since it is
on the same server.

How can I make the filter only grant access to the VO modual?

This is the filter exception I'm using for VO:

public - private port TCP 443 st enabled source-any dest-host-ipaddress
public - private port TCP 80 st enabled source-any dest-host-ipaddress