Are you looking to restrict it so that IP addresses can't be used? I imagine a profile could take care of that, but the easiest way would be to restrict access to trusted sources only, and use a certificate without the IP address as a SAN (that way, it's not trusted if the IP address is used). Otherwise, using an IP address or translated hostname (either DNS, Global DNS or HOSTS file) will work fine by default. Restricting you'll need to use the profile creator (or be really, really good with XML and Cisco jargon).
