how to stop annoymous users to login in drupal
There is the restrict by IP module, which can solve the use-case pretty fast. For the second part, depending on if you are in 7 or 8, you would want to write code to handle a request to either of the routes, evaluate the allowed IPs against the user IP, and do a redirect. Would be easier and more manageable vs the htaccess route, in my opinion.

You can disable user registration by disabling it in the admin (only admins can create accounts).

Furthermore, no one can even get to /admin or administrative pages without the right permissions anyway, so if they are not logged in, it isn't really an issue. That just leaves the login and forgot password page. Forcing a redirect within admin paths might also interfere with things like AJAX actions as well - I would probably leave that alone.