How to block access to Tomcat listening port, and allow localhost only?

I have an application running on Tomcat and listening on port 8080. I made the redirect changes on the Apache level (httpd) to provide my users with the ability to only type http://app instead of http://app:8080.

Now I want to block access completely to http://app:8080, so users won't be able to reach http://app:8080.

How do I do that?