There are a few options.
the admin UI application is in the default tenant and can't be moved, so add all other users to a new tenant. This adds an additional layer of separation
use the
IP ACLs function if you are on the enterprise plan
use a proxy and have the proxy filter out traffic that doesn't originate from the office network and is requesting anything with the FusionAuth admin UI client id (
which is immutable)