Can I allow access to the self-care interface only from one IP address?

Yes.  You can allow only certain groups in your organization to access the self-care interface by giving those groups' IP addresses with appropriate permissions. To do this, add one of the following rules to the Notepad field of one of the customers in the following format:

For a single IP address: 

ACCEPT:1.2.3.4

DENY:1.2.3.4

For a subnet: 

ACCEPT:1.2.3.4/28

DENY:1.2.3.4/28

To allow or to deny access from all IP addresses:

ACCEPT:ALL

DENY:ALL

To allow access from the IP address 1.2.3.4 only:

ACCEPT:1.2.3.4

DENY:ALL

The rules are checked one by one in the order they are specified in the Notepad field. If at least one rule is defined but the requesting IP address does not match your specifications, then access will be denied. For example, to deny only a single specified IP address 1.2.3.4 and a subnet 4.3.2.1/28, the Notepad field should contain:
DENY:1.2.3.4
DENY:4.3.2.1/28
ACCEPT:ALL