If you don't want to have it accessible via Internet, then it shouldn't be hosted in an external cloud in the first place.
However you can restrict access to the app to a IP range, this would serve the goal to restrict access. However, employees working from home wouldn't be able to access the application directly anymore.
https://docs.mendix.com/developerportal/deploy/access-restrictions/#access-restriction-profiles