Yeah, add a deny statement to an extended access-list denying port 67, 68, and 546
67 - BootP Server
68 - BootP Client
546 if you are running IPv6
assign it to the interface inbound and outbound you don't want requests showing up on.
The other solution is to separate the subnets by another router. This will keep the MAC Layer Broadcasts from reaching the wrong interface.
No Ip helper statements, that would defeat the purpose of separating the subnets broadcast capabilities