Keep 443 open for profile updates, but limit profile manager login

Question

I notice that port 443 is used by clients to communicate with the server when profiles are pushed (I assume as an encrypted connection for transmitting the profile file). Therefore it seems that for profiles to be pushed to devices outside the LAN 443 needs to be available when clients come calling to the FQDN to get a new profile (when Apple's push notification service says 'hey something is waiting for you').
However, from a security standpoint I'm not thrilled about exposing the profile manager login to the page to the whole world. Is there a way to limit access to this page to say just our LAN (e.g., using .htaccess) and still allow clients to come calling to the server from anywhere on 443 to fetch profiles? How have others handled this scenario?
Thanks!

Answer 1

...minor updates (see below) after some additional testing. Added /auth as this is another mechanism for authenticating against the admin panel. Also Added an additional allow for loopback traffic since logs showed some items being blocked on : : 1
<Location /profilemanager>
    AllowOverride None
    Options MultiViews FollowSymlinks
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8                   #OUR LAN
    Allow from XXX.XXX.XXX.XXX              #SERVER'S PUBLIC IP
    Allow from 127.0.0.0/255.0.0.0 ::1/128    #FOR INTERNAL LOOPBACK TRAFFIC
    Header Set Cache-Control no-cache
</Location>
<Location /mydevices>
    AllowOverride None
    Options MultiViews FollowSymlinks
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8                   #OUR LAN
    Allow from XXX.XXX.XXX.XXX              #SERVER'S PUBLIC IP
    Allow from 127.0.0.0/255.0.0.0 ::1/128    #FOR INTERNAL LOOPBACK TRAFFIC
    Header Set Cache-Control no-cache
</Location>
<Location /auth>
    AllowOverride None
    Options MultiViews FollowSymlinks
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8                   #OUR LAN
    Allow from XXX.XXX.XXX.XXX              #SERVER'S PUBLIC IP
    Allow from 127.0.0.0/255.0.0.0 ::1/128    #FOR INTERNAL LOOPBACK TRAFFIC
    Header Set Cache-Control no-cache
</Location>