It is always a good idea to have multiple layers of protection- at the firewall, inbound dial plan etc
I usually allow only providers IP through the firewall. As an added security measure (or if you don't use firewall), inbound dial plan can take a condition to match network_addr (IP address of...