I have similar set up on Rackspace.
To allow traffic only from the internal network(s) you can explicitly bind a published port to a specific IP to ensure it’s only accessible from that network.
When you invoke docker run you can use either -p IP:host_port:container_port or -p IP::port to specify the external interface for one particular binding.
Would this help?