I have an API running in a service in my GKE Cluster and it needs to be accessible for some other developers in my team. They are using a VPN so they have a static IP they can provide to me. 

My idea was to just expose the service using a static external IP and restricting access to this IP using a Firewall rule so just the IP of my colleagues.

Unfortunately this just seems to be possible for Compute-VMs because only they can have tags.

Is there a way how I can simply deny all traffic to my service except for traffic from the specific IP?

I appreciate any hints to features, thank you