What should I use: security group or WAF Web ACL

Question

I have EKS cluster that uses Application Load Balancer (ALB).

ALB has security group with only two ip addresses whitelisted. I need to whitelist the requests not only