Thank you for this.

But what about just limiting the access to the BTC pay server app on the umbrel running it? 

Is there a way to do that?