Make Docker container only be accessible from specific IPs/IP-Subnet

Question

I set up a simple container which starts a web application using docker-compose:

version: \'3\'
services:
  app:
    image: app/app:latest
    po