Ideally the deny everything rule should work. Below is a sample filters.any which works fine to deny access to any request to /system/*.
# Deny everything first and then allow specific entries
/0001 { /type "deny" /glob "*" }
# Open consoles
# /0011 { /type "allow" /url "/admin/*" } # allow servlet engine admin
# /0012 { /type "allow" /url "/crx/*" } # allow content repository
# /0013 { /type "allow" /url "/system/*" } # allow OSGi console
# Allow non-public content directories
# /0021 { /type "allow" /url "/apps/*" } # allow apps access
# /0022 { /type "allow" /url "/bin/*" }
/0023 { /type "allow" /url "/content*" } # disable this rule to allow mapped content only
# /0024 { /type "allow" /url "/libs/*" }
# /0025 { /type "deny" /url "/libs/shindig/proxy*" } # if you enable /libs close access to proxy
# /0026 { /type "allow" /url "/home/*" }
# /0027 { /type "allow" /url "/tmp/*" }
# /0028 { /type "allow" /url "/var/*" }
# Enable extensions in non-public content directories, using a regular expression
/0041
{
/type "allow"
/extension '(clientlibs|css|gif|ico|js|png|swf|jpe?g|woff2?|ttf|txt)'
}
# Enable features
/0062 { /type "allow" /url "/libs/cq/personalization/*" } # enable personalization
#CSRF Token:
/0088 { /type "allow" /path "/libs/granite/csrf/token" /method "GET" /extension "json" }
/0099 { /type "allow" /path "/libs/dam/viewers/*" /method "GET"}
Also in rewrite .conf add the path of 404 page like below
ErrorDocument 404 ${AEM_CONTENT_ROOT_PATH}/error/404.html
ErrorDocument 500 ${AEM_CONTENT_ROOT_PATH}/error/500.html