There are two easy ways to accomplish this, depending on how many Tomcat servers you have:
1 - Front your Tomcat server with an Apache webserver and then firewall access to Tomcat completely apart from Apache's IP/port.
2 - Use separate Tomcats and firewall the one hosting the /alfresco webapp from everything apart from Share's server.
Note: You'll have to use slightly more complex rules (or port forwarding) if your users use WebDAV, FTP, CIFS, etc. as these hit Explorer's server.
Thanks,
Mike