For lan hosts, block inbound and allow outbound is fine. If you want, you can default deny inbound and outbound at the edge, but you'll be spending a lot of time troubleshooting and whitelisting, and probably end up having to allow traffic you don't quite understand in order to get stuff to work.
It's more time-effective to reduce your risk of malware in the first place by just not running really sketchy programs. I'd put implementing host-based anti-malware as a higher priority, like Wazuh. And OpenVAS for network scanning.
But this isn't a networking topic, it's cybersecurity.