Restricting DB access to only "localhost" connections

I need to restrict all access to a database except for applications on the server on which the database exists.

I can't simply disable the listener, as it is used by the JDBC client even to connect locally.

I also cannot use a Logon Trigger, as I need to keep even SYS and SYSTEM from being able to log in if it is not from the local box.

Is there some way I can do this either via the listener or via some database system mechanism?

Thanks for any help,

-- Mark