Explanation:

You are securing an Azure Cognitive Search resource with two specific requirements:
Prevent access to Search1 from the internet
The correct way is to use a private endpoint.
A private endpoint connects the Cognitive Search resource directly into your virtual network (VNet), blocking public internet access.
Configuring an IP firewall can restrict access to specific IP ranges but does not fully prevent internet access.
Azure roles and authentication do not address network-level restrictions.
Limit the access of each app to specific queries
This is done via Azure role-based access control (RBAC).
You can assign different Azure roles or API keys with query rights to control what each app can do.
Key authentication alone only provides coarse-grained access (admin/query keys) but does not allow fine- grained per-app restrictions.
RBAC ensures principle of least privilege is enforced.
The Answer:
Prevent access from internet # Create a private endpoint
Limit access to queries # Use Azure roles
Microsoft References
Secure access to Azure Cognitive Search using private endpoints
Role-based access control in Azure Cognitive Search