It is possible to limit access (e.g. by IP address) to secured hosted services in ArcGIS Online for public-facing web applications as detailed in this Esri technical article: https://support.esri.com/en/technical-article/000017029 Step 3b requires the user to store credentials with the service item using a built-in type ArcGIS Online user account. Somne large organizations require the use of SAML-based authentication for ArcGIS Online and therefore cannot support this workflow.
Request and use case: It is requested that the ability to limited access (e.g. by IP address) is extended to non-secured ArcGIS Online hosted feature services in addition to secured services.
Based on the user and the Department requirements, the services must be: