Well, you cannot completely avoid images, you can only suppress them sufficiently. How much "sufficiently" is is completely up to your application! So, we can't tell you this.
However, thanks to the fact that you're comfortably oversampling your 400 kHz, the first aliases would appear at 2.93 MHz (=lowest frequency in signal, i.e. -400 kHz, plus sampling rate). How sensitive is whatever will get that signal to energy at 2.93 MHz or higher?
Assuming 50 dB attenuation totally suffice at 2.9 MHz, a simple split-into-two-stages, fourth order Butterworth filter would do:
Designed with the analog devices filter design wizard
Implemented as Sallen-Key active filter, that'd amount to four capacitors, four resistors and two relatively cheap opamps. Plus one capacitor and a high-valued resistive voltage divider to AC-couple in the signal, which, since it's got no DC component, can be shifted to an arbitrary voltage, so that you can work with a single supply voltage here.
So the answer here is: well, no matter what you need, it's not very hard, might as well go for a pretty good filter. Assuming you want your passband to be very flat, you want a Butterworth filter, and if you choose that, you'll want an even order one, and second-order isn't going to be steep enough, so fourth order it is. You can do better, but unless you know why, you won't need to.