Use the builtin source
alias/directive/whatever:
restrict source nomodify notrap noquery
Updatedd to include documentation for source
:
restrict source configures a template restriction automatically added
at runtime for each association, whether configured, ephemeral, or
preemptible, and removed when the association is demobilized.
From: http://www.eecis.udel.edu/~mills/ntp/html/accopt.html#restrict