Does anyone have a way to access domains only for a few public IP addresses, and is there a way to access multiple URL paths such as example.com/user/payment which can be done publicly?
To do this I recommend creating a WAF custom rule that is set to block the requests if the request is not coming from one of the IP addresses you specify in the rule.
Here is an example of a Custom rule that is similar to what you are trying to achieve. You would have to edit this rule to match with your desired results.