A company stores sensitive documents in an Amazon S3 bucket. They need to ensure that these documents can only be accessed by requests originating from a specific range of IP addresses within their corporate network. The company wants to enforce this policy at the bucket level. Which approach should the company use to restrict access to the S3 bucket based on the originating IP address?