WOPI Documentation on security is a bit unclear to me

Sorry about that. For clarity

In other words should there be IP-adresses or hostnames of the expected clients? The IP-address or hostname of the WOPI server?