By default, the Plesk GUI can work on all IP addresses available on the Plesk server (from the server’s IP pool). You may want to allow access to the Plesk GUI only from the local network. For that, you should move the GUI to an internal IP address.

To move Plesk GUI to a separate IP address, in the configuration file /etc/sw-cp-server/conf.d/plesk.conf, replace the lines

listen 8443 ssl
listen 8880;

with the lines

listen SPECIFIC_SERVER_IP:8443 ssl
listen SPECIFIC_SERVER_IP:8880;

where SPECIFIC_SERVER_IP is the new IP address that you want to use for the Plesk GUI.

Do not change the ports.