How to secure ATP (DB Layer) in terms of IP Whitelisting but allow access to APEX App (Web Layer)

Summary:

How to secure ATP DB in terms of IP Whitelisting but allow access to Web Apps layer i.e. ORDS, APEX

Content (please ensure you mask any confidential information):

We have our ERP SaaS extensions built in APEX hosted on ATP DB. We want APEX App (and ORDS) to be accessible from anywhere in the world but direct access to the DB must stay restricted - how can we achieve that?

Version (include the version you are using, if applicable):

19C

Code Snippet (add any code snippets that support your topic, if applicable):

NA