If you want only traffic allowed from a given source(s), your first step is probably to ensure that firewalld's default zone is set to public — or even drop — making sure to add exceptions for just those ports and IPs you wish to give access to.

As a caution: make sure that before you change your default zone that you have other access to your system: if you enable a restrictive default zone without having exceptions ready to go, you'll lock yourself out.