I'm wondering what you mean here when you say "on the local device". Are you implying that it is guaranteed that the local device is not exposed? I don't see why you would have to explicitly expose something. The entire instance is exposed by default.
But that has nothing to do with the instance access control or the database access. Changing the listening interface isn't going to magically fix the default security setup.
If you want to expose anything, you have to do it very explicitly and as linked there are warnings and advice about doing so.