Restrict access to amazon WorkSpace by IP Address?

I have a simple question which I don't think has a simple answer.

I would like to use Amazon Workspaces but a requirement would be that I can restrict the IP addresses that can access a or any workspace.

I kind of get the impression this should be possible through rules on the security group on the directory, but I'm not really sure, and I don't know where to start.

I've been unable to find any instructions for this or other examples of people having done this. Surely I'm not the first/only person to want to do this?!

Can anyone offer any pointers??