Exchange. How to properly close access to ECP for the outside world?

Question

Microsoft Exchange

Good afternoon.
Please tell me how to properly close access to ECP for the outside world?
It seems to be closed through IIS ip restrictions, access to / ecp is closed by restricting IP
But if you go through the nameserver.com/ecp link for the first time , then there is a redirect to a link like

http://nameserver.com/owa/auth/logon.aspx?replaceCurrent=1&url=http://nameserver.com/ecp

Not hunting and not right because of ecp to cover access from the outside to / owa.
How to do it right? So that the authorization page for ECP also does not exist from the outside.
Thanks in advance
Exchange 2016