It can be done, (like some users answered already) if you are using IIS you can block access from certain IP's or all IP's and then give access to only the IP's / range of IP's that you want to access the web app.
On another hand, there are some pretty good security models for php where you can block an IP from connecting straight to your web app.
This is what I did, you can slap a firewall in front of your web app, put your web app on a port that's not port 80 then block access to it from the firewall, THEN, install a vpn in your LAN and on the office's devices, so, if a user wants to connect to the web app from an external location he / she will have to grab an office device and login through the vpn, and install that vpn ONLY on the office's devices (you enter the password), complying with what your bossed asked for, to only connect using your office's devices.
Just for kicks, or to prove to your customer that it works, you can enable your application to log the username and IP used to login to the application.
Something in the likes of this is what you would see, I got this from my MySQL server log for a certain web app:
id, datetime, editdatetime, ip, user, table, action, description
70941, 2017-05-12 16:06:27, 2017-05-12 09:06:27, 24.153.197.xxx, jenxxx, oasis, edit, ---Keys
id : 96846
Int Stat [old]:
Int Stat [new]: 4
The log is telling me that the user jenxxx logged in from 24.153.197.xxx (external ip) and edited the registries with the id's stated after the keys id section and the changes she made.
This is from a php / mysql web app, and I can add a restriction for the user to connect using ONLY certain IP from 8 am to 5 pm and Monday through Friday only, and that goes embedded into the web app's security feature, even IE would be able to pick up these information from the device and / or the server itself.
It can be done, it just takes a little bit of work.