Code for the current version of Apache (2.4)
Require ip xx.yy.zz.kk
Require all denied
Is it possible to have access from other IP address?
No, unless the source IP gets spoofed by the attacker
Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?
Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks
In particular, while a very single packet can be spoofed at no cost, you should both know that 1) it won't likely survive your ISP's first hop, and that 2) it takes fully stealing an IP address class in order to fully establish and maintain a TCP session to a firewalled box. This BGP hijacking is something you can't realistically do home, as you need large control over network and BGP routes. Network providers are aware of this threat and are working on multiple solutions, like authentication, RPKI (RFC 8210) and the BGPSec protocol (RFC 8205), to mitigate.
Conclusion: as for your firewall, it will work as expected and you can rest assured. Further comment: you may also like defense-in-depth and I recommend you to add additional security measures, e.g. strong authentication at application level