Restricting a user to a specific source network IP address
The solution was to implement a Network Kernel Extension that changes the source IP of the socket based on the user ID. 

More on NKEs can be found here