IP Restrictions per Access Level - e.g. Only limited users can sign-in publicy

I would like to be able to restrict access for our employees so they cannot sign into the sign from outside our network.

In my situation all employees have Full Access. So, e.g., it would be nice to apply an access list that said Full users can only sign-in from X subnets/networks/IPs.

Could be a per Access Level setting too for extreme granular choice. Could also be per user, or per policy.

The main reason for this is that I would have to worry less, if at all about an employee placing a file in the folder, not sharing it, then signing in from home. Yes there are audit logs, but that just tells you what happened, it does nothing to prevent the theft.