so is there a way to give a rule an affinity so that it can’t be executed remotely?

no but I believe shouldn’t be an issue. as the person using your plugin would have had to explicitly configure remote execution mode.