Code for the current version of Apache (2.4)

    Require ip xx.yy.zz.kk
    Require all denied

> Is it possible to have access from other IP address?

No, unless the source IP gets spoofed by the attacker

> Or maybe someone can make fake requests signed as from xxx.xxx.xxx.xxx client?

Unlikely if your "public hosting server" is on a hardened network that will try to prevent blatant attacks

References:

- https://security.stackexchange.com/questions/55279/how-easy-is-it-really-to-do-ip-spoofing

- https://www.cloudflare.com/en-gb/learning/ddos/glossary/ip-spoofing/

In particular, while a very single packet **can** be spoofed at no cost, fully **stealing** an IP address in order to fully establish a TCP session is something you can't realistically do unless you have control over network and BGP routes, which historically were not [authenticated][1]

Conclusion: your firewall will work as expected

  [1]: https://www.juniper.net/documentation/en_US/junos/topics/topic-map/bgp_security.html#id-understanding-router-authentication-for-bgp