IP-based access controls are not generally sensible because there is no 1:1 relation between IP addresses and users. Multiple users may share the same IP address if they are behind Network Address Translation (NAT), and most users/devices don't have a static IP address. For most internet connections, the IP address is assigned dynamically and the assignment may change infrequently. Additionally, mobile devices (laptops, phones) may frequently move between networks. E.g. a client may use your service from an office on one day, but work from home on another day.
The only scenario where IP-based access controls make sense if all clients have a static IP address for their office. This is part of many but not all business-oriented internet packages. If the client wants to work from another place they would have to configure a VPN so that they can remote into the office network, then access your app from there.
IP-based access controls can be implemented in a number of ways:
within the web application, where you check the request metadata. This is the most flexible way and allows you to associate IPs with accounts. Be aware that you want the original request IP. If your app is behind any cache or proxy they should insert the original IP as a header (usually X-Forwarded-For).
with a gateway server in front of your web app, e.g. if you run your app behind Apache as a reverse proxy. You will have to update the server configuration for each new client.
with firewall rules, with which you can whitelist specific traffic types (e.g. allow TCP traffic to port 80 from customer IP, else drop). However, you'll have to update the firewall config for each new customer since you can't allow access to only your login page and not the rest of the site.
by requiring the client to set up a VPN/network bridge from their router to your router. Since all clients connect to the VPN they appear within your network, so your firewall can simply block any incoming traffic that isn't VPN traffic. When properly configured this is a very flexible and very secure mechanism, but requires enterprise-level router equipment and experienced administrators to set up.
So clearly any of these except the first solution (check request metadata within your app) are likely impractical.
While IP-based access controls can contribute to good security under some circumstances, they tend to be inflexible and inconvenient. They will also annoy potential clients who do not have a static IP address. Most likely other mechanisms to fortify your login may be more flexible and add more security, such as encouraging users to pick strong passwords, rate-limiting login attempts (for which per-IP address rate limits may be sensible), password-less authentication via OpenID identity providers, or multi-factor authentication.