Shield and Filters

Hi, 
I have a site with a public front end with multiple pages and then several modules that can only accessed by authorised users. I know I can use filters in the config, but the list of publicly accessible pages is long. So, is this type of approach best achieved using filter on the routes instead? 
However, if I remove session from the filters then I don't populate the last_active user field, which I want to use. What is the best practice for something like this?
Thanks,
Mark