How do you do strict tls or deny traffic from non-mesh members?

How can I set Consul to use strict TLS or essentially deny traffic that is not within the mesh. I want to allow mesh members to reach each others, but those that are not part of the mesh should not be able to reach members within the mesh?