Securing a web API Best practices in the Appian cloud

I am using Appian 19.4 and I am building an API that will be accessible by another system internally in the company's network. (This API doesn't need to be public facing) Questions:

1. Is there any way, in the Appian cloud, to restrict a particular API to be accessible only within the company network so that it is not accessible in the internet? 
2. What other security measures, besides the use of an encrypted API key for authentication purposes, can be used to add extra security?

Thanks!