do you mean with "VNC IP" the WebGUI with its novnc socket?
If yes they listen on all interfaces by default.
You have to restrict them with the firewall.
If the firewall is enabled only in the local network, it is allowed to connect to this ports.
When you don't know what your local net is use