Restrict access to an App Registration / Enterprise App to be from just a single IP or server

as per the question title - I would like to be able to restrict access to an AAD App registration / Enterprise App so that just a single server or IP can authenticate and use the app.

The App registration is currently set up to use a client secret for access which is called via  python. I have tried setting up conditional access policy to restrict to a named location that contained the single IP address but discovered that CA IP restrictions only apply to user authentication and not to programmatic using secrets.

This is something that is being developed so we can be adaptable and reconfigure things is required but Im struggling to find a way to restrict things in this way to be restricted to a single server. The server is currently on premises but we are migrating everything into Azure anyway, so if there is a solution that requires the server to be in Azure , such as creating and using an endpoint for example, that might work also.

I was also trying to look into the possibility of using a certificate instead but wanted to see if an  issued certificate could be configured to only work from a single IP or MAC address for added security.

Hopefully someone will have so ideas that can help me with this.

Thanks for any suggestions