I deployed mentioned container and was able to set up private DNS.
At first setup promt you're asked for the administrator interface so you can either change it to localhost (but then you need to access this instance from inside network which is very cumbersome and complicated) or: make it available in all interfaces but change port from 80 to something else (its just unencrypted http). I haven't found a feature allowing you to server admin panel over HTTPS unless I missed something.
If you set up admin panel at some other port then you can easily create firewall rule allowing incoming connections from just one IP (or a range of IP's).
---------- UPDATE ---------
To block request for /admin you can use Cloud Armor based on a URL and/or IP. You can block all the traffic going to admin panel with the exception of one (or a range) IP(s).