One thing I always do to protect against midi controllers/keyboards sending midi CCs to plugins is to block midi CCs in the settings of the midi in blocks in my rackspaces. If I want a midi controller CC to control something, I create a widget for that rackspace to respond to that CC and control the plugin directly.
I had an issue where my Kronos would send out CCs that would affect plugins in strange ways because the midi in blocks were passing on the messages.