Consul supports strict mTLS?

Consul
1

How can I require strict mTLS, so that services outside of the mesh cannot communicate with mesh members? Is ACLs absolutely required?

I deployed a service mesh with these values, and I had hope the TLS configuration would be enough to get this behavior?

global:
  name: consul
  datacenter: dc1
  tls:
    enabled: true
    enableAutoEncrypt: true
    verify: true
server:
  securityContext:
    runAsNonRoot: false
    runAsUser: 0
connectInject:
  enabled: true
controller:
  enabled: true
ui:
  enabled: true