How to secure a web application that uses a JS tracker?

Question

Information Security

Hello.
I'm a complete noob when it comes to security, so I'm asking the community to point me in the right direction.
I have a JS library that is loaded on a client's site and tracks certain user actions. The collected data is then sent to the server (API / Tornado), with subsequent saving to the database (Mongo).
What threats should be closed first of all and how to do it?
Please tell me or I will be glad to provide links to materials on the topic.
The first thing that came to my mind was to limit the ip addresses with which the server (on which the base) can interact. Would such a solution work?