How to only access through VPN?

May be.

  1. Remove all public ip/port declaration from fly.toml.

  2. And then connect to app vms from your Mac/PC with flyctl wireguard or connect among app vms over 6pn.