you cannot directly use MAC address anywhere source /destination since it' s a Layer 3 device.
but you can use device if the device detection has enabled,which will provide you more confidence that no other devices are connecting through the policy.
The screenshot which you are attached shows the traffic is accepting through the policy.
And if you don' t want to make any security on those machines you can leave UTMs features none as like now.
But since you are using a great UTM product , it' s highly recommend to utilize those features to secure your network.
I don' t believe your manager will ask you to open connections to an infected website.. :)
You can have multiple security profiles according to your environment and users.
Cheers..!
