App Hosting's Load Balancer is not configurable, so there is no way to restrict traffic origin before it hits the application.

Provide a way to support Authenticated Origin Pulls, either by providing configuration access to the underlying Load Balancer, or via built-in support. https://developers.cloudflare.com/ssl/origin-configuration/authenticated-origin-pull/