A company runs several Compute Engine VMs in a VPC network. The security team wants to ensure that only specific inbound traffic (for example, HTTPS from a known load balancer range) is allowed to reach these VMs, while all other inbound connections are blocked at the network layer. Which Google Cloud capability should they use to enforce this control?