If you're using Linux Apache you can whitelist a list of IP addresses to access the server in htaccess, essentially banning everyone but your clients.
If you use this method, simply change the htaccess file on days when you need to ban everyone but your clients, and change it back on days when you want to give access to the world as well. You can even automate the htaccess updates in PHP if you want to get fancy and don't want to make the changes manually.
Htaccess IP banning is how websites combat DDoS attacks, and is pretty much the only reliable method that is used. You can learn more about htaccess IP banning at stackoverflow, as there is much written on the subject. The only other common method of stopping DDoS is to use a service such as Cloudflare which detects the IP address of users before they access your website. If the IP address is a known DDoS attacker, Cloudflare bans them from accessing your site.
However, if you know the specific IP addresses of the people DDoSing you, all you have to do is ban those exact IP addresses in htaccess. This is how almost every major website combats DDoS. You can find the IP addresses of DDoS attacks by looking over the logs on your server.