The vast majority of desktop computers will not need 445 inbound. If you happen to have some enterprise tool that does, just add an allow rule for those particular servers. This protects you against a large number of other attacks such as ransomware over the local network too.