Allow remote access only from certain IP addresses
I use Windows Firewall and Powershell for this.  Unless of course you want to get something like ScaleArc to act as a reverse proxy.  Your options are really going to be rather limited to something that utilizes one of those technologies.  Firewall/IPSec or a reverse proxy.  

This is the outline of the script I use to verify ports the rule exists in this environment and add it.  Specify -RemoteAddress to limit access to only certain IPs:

New-NetFirewallRule Docs

-RemoteAddress&lt;String[]&gt;
Specifies that network packets with matching IP addresses match this rule. 
This parameter value is the second end point of an IPsec rule and specifies the computers that are subject to the requirements of this rule. 
This parameter value is an IPv4 or IPv6 address, hostname, subnet, range, or the following keyword: Any. 
The acceptable formats for this parameter are: 
-- Single IPv4 Address: 1.2.3.4 
-- Single IPv6 Address: fe80::1 
-- IPv4 Subnet (by network bit count): 1.2.3.4/24 
-- IPv6 Subnet (by network bit count): fe80::1/48 
-- IPv4 Subnet (by network mask): 1.2.3.4/255.255.255.0 
-- IPv4 Range: 1.2.3.4 through 1.2.3.7 
-- IPv6 Range: fe80::1 through fe80::9 
Note: Querying for rules with this parameter can only be performed using filter objects. See the Get-NetFirewallAddressFilter cmdlet for more information


.

Powershell Script:

##Internal SQL Endpoint for AGs to communicate together. Needed on all nodes.
$LocalPortNumber = '5122'
$PortDisplayName = 'SQL-AG-Endpoint'
$Protocol = 'TCP'
$PortCheck = Get-NetFirewallPortFilter | where {$_.LocalPort -eq $LocalPortNumber}
if ($PortCheck){  ##Check if exists))
write-host "Port $($LocalPortNumber) for $($PortDisplayName) already found. Not adding Firewall Entry" #-ForegroundColor DarkGreen
}
ELSE
{
write-host "Port $($LocalPortNumber) is not found. Adding now" 
New-NetFirewallRule -DisplayName "$($PortDisplayName)" -Direction Inbound –LocalPort $($LocalPortNumber) -Protocol $($Protocol) -Action Allow
}