Restrict access web console on internet

Restrict access web console on internet

We want to use agent to scan the laptops out of office , but the agent port and web console port is the same , so any user can open the web console on internet , we just want to access to web console through the LAN ,  what should we do ? thanks.