Restrict access to a anonymous app within intranet

Summary:

Content (required):

We have developed a Webapp and made it 'anonymous' so that every employee within the organization can access as we do not have/want to configure SSO.

But we also want to restrict access to the app to the 'intranet' only and not in public internet.

Is there any way to achieve this ?

Will IDCS level 'Sign-On Policies' hep us achieve this in any way if we restrict the app's sign on polies to only certain IP's ?

Or any other way to achieve this ?

Version (include the version you are using, if applicable):

Code Snippet (add any code snippets that support your topic, if applicable):