firewalld Zones and Least-Privilege Access

One approved client may reach the app on server1; a second server on the same network may not. Write the narrowest firewalld rule that says so, make it permanent, and prove it from both sides.