It's helpful that access can be limited by IP address, but for further protection would find it important to be able to limit access based on staff schedule. For example, a user who is scheduled Mon-Fri should only be able to log in on those days.