How to block all urls and only allow 1 / 2 url as public?

Hi I have an application with sso all the clients and server is on same IP (using sub-domains). A central application auth is made in ci which accepts the login from the other node application. I want to allow only those applications which are on my sub-domains to access auth and block all other IP’s who tries to access the auth. There is an admin section made on auth basically made to deal with user creation and updation. The url is suppose auth/admin. I only want this url to be accessible publically and few others related to it. Any suggestions will be helpful.

Thank you in advance.