[Zope] Deny public access to ZMI

Hello, Is there a straightforward way of defining which IPs are authorized to access to ZMI? I want to block public interface access and allow it only from internal network - VPN. I don't want authentication box to pop up to any single visitor with a browser. It is Zope 2.9.4. As I searched, I came across with docs of how to write scripts to define access rules to the specific folders. Should I go that way and implement an access rule for /manage? Thanks, Ustun