I setup a DDNS domain on my home router and forward the port to one of always-on virtual machine. However I want to add more security by only allowing access to my domain for a specific public IP range (my work)
is this feature supported in free or pro plan? Also where to configure it?
This feature is not supported by a service in particular or by DNS in general. Instead it would be part of your port forwarding rules on the router. You should be able to define the allowed source IP address range.
Another possible option could be to define this restriction at the final destination service.