What practice should I use to protect my web application from reflection?

I know there is no way to fully protect your source from decompile or software like Reflactor.
What I mean is adding some access rule to my binary and add permission control to it.
My web application needs to get data from database and response to client ASP.NET request (80).
What kind of setting is suitable?
like [SecurityPermission(SecurityAction.LinkDemand, UnmanagedCode = true)]?
or Access Rule to restrict only IIS can access my assembly?
Do you recommend using obfuscator?
...