As a quick test you could block SNTP on an S-Series using an ACL. You would lose time synchronization for that switch for the duration of this test.
Another possible test would be to generate a different directed broadcast packet and see if ARP requests are generated (note that ARP request generation is rate limited).
If there are other packets sent to the local broadcast address x.x.255.255, those should result in ARP requests from the S-Series as well.
You might want to take a look at the following GTAC Knowledge article (the 7100 switches use the same EOS as the S and K Series):
I think you do not want the S-Series switches to act as routers. If the S-Series have interfaces in both the VLAN-2 and the DMZ, by default they would forward IP packets between both networks.
BTW, enabling directed broadcasts on SVIs is needed to send a directed broadcast from a different network to the SVI's subnet only. As I understand it the directed broadcast is generated inside the network it is destined for, no forwarding needed.