We don't have a way of whitelisting IP's for ingress into the network right now. The best you can do would be to only allow access via the VPN, and add the netclient (or ext client) to any machines that need access to the internal network