Limiting access of EC2 app to our developer's IPs without using security groups

Question

On AWS, our EC2 container hosts an app that runs both a backend and frontend server. The frontend server is our customer facing app that we want open to the public, and our