Thank you for your help! I am hoping that this is enough to lock down nuget restores:

API Keys for Pulling/Listing Packages
Most clients will not send the API key for operations like listing or pulling packages. In this case, ProGet will issue an authentication challenge, and the client will respond by prompting for a username and password. In this case, you can supply api for the username, and your API key for the password.

I'll test that.

I'm interested to know if anyone has set up Proget with access control varying by ingress. Here's what I'm after:

1. Devs on the local network (i.e. in the office or on VPN) can anonymously pull packages for restores, and authenticate to push packages
2. CI systems not on the network must authenticate to pull packages for restores, and for pushing packages

It's ok if I need separate host names for each of the above cases, but ideally all the interesting auth parts would happen inside Proget.

How do people secure their Proget servers for package restores?