If I want to globally disable access to part of an enterprise application that uses Seam should I use a ServletFilter or use the EJB Interceptor model?

I must be able to disable access from web services and from web pages but still allow some functionality to conintue in other parts of the enterprise application.

What's the best way to do this? Thanks.