In 4.0 model there is .spec.restrictByIP in kind: BackupUser but it does not work.
It should allow to restrict by IP address and hostname (hostname should be translated to IP address dynamically when checked, not when created the user).

Examples:

---
apiVersion: backups.riotkit.org/v1alpha1
kind: BackupUser
metadata:
    name: admin
spec:
    # (...)
    restrictByIP:
        - 1.2.3.4
        - admin.example.org