Assuming the Linux box has more than one interface, only have samba listen on the internal secure wired interface (if that's the one you're using) - which pretty much precludes the internet or wireless interfaces being able to access it ever. Use the "bind interfaces only" command.