I have a tasking to filter everything except *.gov domains from web app

I have been tasked with filtering all traffic from my web app except *.gov clients. I have limited things available

in the Government Azure. Does anyone have any ideas to make the NSG's block with domain names and not by IP addresses?

Jim