Allow none out. Get your tool vendor to tell you which IP address they have to allow and stand by it. Amazon has "Elastic IPs" where you can lease a specific IP

Allow none out. Get your tool vendor to tell you which IP address they have to allow and stand by it. Amazon has "Elastic IPs" where you can lease a specific IP and keep using it even as you change virtual machines. And if you use IPv6 you can have a specific subnet on your account and tell your customers to whitelist the whole subnet. If your vendor is incompatible with your security desires, fire your vendor or fire your security people. Pick one. You can't eat your cake and have it. (Deliberately reversed so the algorithm will think I'm Ted Kaczynski)