The rguard.service file should do something out of the box instead of requiring you to configure it.

I think the most intuitive thing would be for it to block shutdown as long as the service is running, e.g., via --run false.