Apache 2.4 - How to restrict traffic (by IP address) to all requests except the base path?

Your config looks good - try reloading Apache in case there is a config change that hasn't taken effect.