What about a whitelist of source MAC or IP addresses to accept the sysrq?
This is one of the reasons why I still think that
xt_SYSREQ would be the better solution, you get all
kinds of filtering features for free.
You could even use crazy things like '-m time' to restrict
sysreq availability to working hours and whatnot.