Cisco IOS: How to close ports 2001, 4001, 6001, 9001?

I am configuring a small branch router and found that every interface of the router has following TCP ports listening and issuing login prompt:

Starting Nmap 7.60 ( https://nmap.org ) at 2020-11-02 10:34 CET Nmap scan report for XXX (XX.XX.XX.XX) Host is up (0.016s latency). Not shown: 996 closed ports PORT STATE SERVICE 2001/tcp open dc 4001/tcp open newoak 6001/tcp open X11:1 9001/tcp open tor-orport 

2001 is con0 line access, which I want open only on Loopback0. The rest I want closed unconditionally. How do I do that -- without using ACLs. I cannot use ACL with access-group in since this is PE router and it won't work for traffic not coming from the interface.