Firewall vs vhosts restrictions?

Question

Nginx

Hello!
We are pushing a new reverse proxy into the DMZ, and since the configuration will be in the pappet, and not manually, as before, a small question arose.
I can restrict incoming connections on the firewall by editing the role (which creates a certain hassle with maintenance), or edit the inputs on nginx, but then I open ports 80 and 443 on the firewall for absolutely all hosts that will go through the iron firewalls, which I don’t really want to do either for security reasons. I would like to ask respected comrades how they would act in this situation.
How safe is it to set up nginx to monitor and filter source addresses?