h2non

You can create your own rule to do that, for instance, inspect the request remote connection address.

Then, you can apply that rule to the bandwidth poison. The poison will be only applicable if the rule passes.