You can configure an access-port group for all the edge ports on the access switch. Then the group as a whole can be configured for bpdu-block-on-edge. This will make sure to disable any edge ports that will receive BPDU packets from the downstream devices. You would also want to set a bridge priority of 0 to your root bridge ( this could be your distribution switch for this case). You can configure the no-root-port statement on your root bridge as well, this will make sure to block any superior BPDU received from downstream devices, which helps in unnncessarily changing the STP topology. Basically, you should avoid closed form architecturs on your switching topology such as triangle, square or any irregular closed form as much as possible to prevent loops.
You can configure an access-port group for all the edge ports on the access switch. Then the group as a whole can be configured for bpdu-block-on-edge. This will make sure to disable any edge ports that will receive BPDU packets from the downstream devices. You would also want to set a bridge priority of 0 to your root bridge ( this could be your distribution switch for this case). You can configure the no-root-port statement on your root bridge as well, this will make sure to block any superior BPDU received from downstream devices, which helps in unnncessarily changing the STP topology. Basically, you should avoid closed form architecturs on your switching topology such as triangle, square or any irregular closed form as much as possible to prevent loops.