Restrict Postgres superusers to local only connections
You'll have to enumerate the superusers:

host   all  superuser1   0.0.0.0/0   reject
host   all  superuser2   0.0.0.0/0   reject
host   all         all   0.0.0.0/0      md5


There should be a very limited, fairly constant set of superusers.