CORS on its own only tells the browser / client apps to stop sending requests, in many ASP.Net Web API implementation it doesn't actually block the request pipeline. This is why Postman works, Postman doesn't execute the same pre-flight OPTIONS check first, it just send the request.

You should absolutely look into adding authentication to your API, Bearer token based authentication works well enough with and between APIs. Have a read over Secure a Web API with Individual Accounts and Local Login in ASP.NET Web API 2.2, but that is out of scope for this question.

At a conceptual level, you just need to intercept the incoming request in the OWIN pipeline before the API middleware and request the request if it doesn't match your rules. This should be using in conjunction with CORS so that browsers respond in a standard way.

For background, have a read over Block or limit unwanted traffic to Asp.Net Web Application. Usually we manage domain or IP level security filtering in the hosting architecture or routing. IIS or Azure hosts have many built in policies to help manage this.

You could implement this at a global level by adding the following OWIN request processor:

public void ConfigureOAuth(IAppBuilder app)
{
    app.Use((context, next) =>
    {
        string[] AllowedDomains = new string[] { "::1", "localhost", "mybusinessdomain.com" };

        if (!AllowedDomains.Contains(context.Request.Host.Value.ToLower()))
        {
            context.Response.StatusCode = (int)System.Net.HttpStatusCode.Forbidden;
            return System.Threading.Tasks.Task.FromResult<object>(null);
        }

        return next();
    });

    // TODO: add in your other OWIN configuration AFTER the request filter.
}

If you are NOT using the OWIN hosting pipeline and you want to manage this globally then you could put a check into the global.asax.cs toi handle the Application_BeginRequest:

   private static readonly string[] AllowedDomains = new string[] { "::1", "localhost", "mybusinessdomain.com" };

   protected void Application_BeginRequest(Object sender, EventArgs e)
   {
       if >(!AllowedDomains.Contains(HttpContext.Current.Request.UserHostName.ToLower()))
       {
           HttpContext.Current.Response.StatusCode = (int)System.Net.HttpStatusCode.Forbidden;
           HttpContext.Current.Response.End();

           // or transfer to a specific page
           // Server.Transfer("~/banned.aspx");
       }
   }