Restricting Access To Website From Public

I'm creating a web application for my company now. This application has 2
parts. 1 part for the customers to access. The 2nd part is for our staff to
access only. My director hopes to make the 2nd part to be something like an
intranet, such that only our company's computers (maybe only 1 or 2 in the
company) can login to this part of the application.

1. My company's intending to put the application on shared server with a web
host. Windows Authentication is NOT allowed.

2. My company doesn't have a static IP address.

3. My manager suggested using Network Card number (which I don't really
quite understand. Is there a way to get the Network Card number that's on a
client PC?).

How??

Some ISP told us that they can provide a firewall management feature such
that it will restrict access to the website from anyone that is not coming
from my company's network. This requires Static IP.

Another told me that IIS Manager has the security feature that restrict
access based on IP address. This requires Static IP again.

Is it possible to implement the 2nd part (the part that is to be accessed by
my company's PC) as a windows application instead? Then we only put the
windows application on one computer. So, 1st part (for the public) will be a
web application, 2nd part (for my company) is a windows application, both
accessing the same database server from an ISP. Will the ISP allow the
windows application to access its database server? I've no experience in
making a windows application at all, is it the same as making a web
application?