How can a Logistics and shipping solution company ensure that Compute Engine instances in their production project do not have public IP addresses while allowing frontend application Compute Engine instances to have public IPs, using the Google Cloud service, and ensuring that only team members with the appropriate role can modify resources?