htaccess limits

Looking for best practice, please.  A <virtualhost> uses html web forms 
that pass data to a perl/cgi script /wherever/cgi-bin on the same server 
-- unfortunately outside bad actors try to POST unwanted data into that 
script directly.

What is best practice to disallow all access to the cgi-bin except for 
the local web form.  I have a vague memory of 127.0.0.1 being usable by 
apache 2.4.x

Thanks in advance -- Paul