Based on the limited information:
At a minimum your looking layers of security you trying to accomplish.
- We'll call this the DMZ. This is the layer that Application A is accessed at, or more simply put, the point of entry for your setup. You don't want anyone beyond this point.
- The next layer is the backend. This is your application B and you are trying to restrict the access to this application only through Application A.
At a network level, your best option is through white listing of IP's/Domain Names. If you truly are just in development, and you basically trying restrict users/ other devs from messing with a system that's no ready, simply while listing at your servers FW will probably be sufficient.
You don't need to have a FW in between for something this basic (unless your development demands a certain level of protection upon which I would suggest no using these forums and hire a professional. This place is great for information, but specific engagements shouldn't be done here)
You should know the IP and Ports that Application A and B talk on which is what you want to white list.
If/when you push this into production I would make a few suggested changes.
- Depending on your level of required security, use a dedicated firewall to separate your DMZ from the backend (Your organization may have this already).
- Use Third Party Signed Certificates, I believe the current best practices are Minimum Key length of 2048, SHA2 signatures, running on TLS 1.1 or greater.
- Secure the at the server level. Set your group permission properly, etc for the application. (I am not including actual server security recommendations, but that should be a given).
- Know you DMZ access level, and internal application doesn't need to be access by external IPs, and you IT team should know what IP scheme they use and if they are really on the ball, they'll know what IP range will be accessing the application for the dedicated user group.