You could achieve this with a custom expression during role mapping: "The IP address of the machine on which the user authenticates. Caveat: In the resource policy, netmask can be specified using the bit number or in the netmask format '255.255.0.0'" Base on this you can assign the role to the restricted users.
... View more
