It’s not a simple configuration to declare the list of Mobile devises allowed to connect to the mobile application in AEM.  

However, as part of the customer username/password authentication that they have coded in their PB application, they can add an additional check to make sure that the mobile devise is an authorized one.  Appeon provides a PB function the customer can call to retrieve the  mobile device ID.  The function is: eon_mobile_deviceex.of_getdeviceid()

 Appeon is not a Web server.  It runs on any of the leading Java servers or IIS.  So the Web server security is provided by these third-party products.