If your company uses GSuite & logins via 'Login With Google'

Firebase's Google Login is built on top normal Google Logins + a lot of automation.A Among these is when the part when they create a new OAuth 2.0 Client in GCP. This would be named Web client (auto created by Google Service)

This client is auto-linked to OAuth Consent Screen where you can mention your App's Display Name and limit it to users in your organization with a Google account

If your company uses Email & Password login

The easiest method is to immediately immediately check for organization email via firebase background auth trigger onCreate as mentioned in Ben's answer. If the account does not belong to your organization - delete it immediately.

This would tho for a brief moment give access to your system to the malicious user. To further protect, you can set custom claim to your organization user (when they register - in firebase function) & make sure every request to firestore/real time database has those custom claim checked. Similarly you can check for custom claim in firebase function before making call to your database

Case 1: The user has already created their account, and you want to restrict one cloud function to specific email addresses.

You can get the user info associated with the cloud function call, and check their email. You can then call the external database if they have the correct email domain. You should also do some UI changes so the user doesn't just get errors if they don't have @cat.com.

Case 2: Restrict all users in your Firebase project to emails containing @cat.com?

If so, you can't restrict the emails directly in firebase authentication, so you'd have to stick user registration code behind a cloud function, creating user accounts there. You can then check their email when they try to register.

You can do this with the Firebase Admin SDK in a cloud function. docs

admin.auth().createUser({
  email: 'user@example.com',
  emailVerified: false,
  phoneNumber: '+11234567890',
  password: 'secretPassword',
  displayName: 'John Doe',
  photoURL: 'http://www.example.com/12345678/photo.png',
  disabled: false
})
  .then(function(userRecord) {
    // See the UserRecord reference doc for the contents of userRecord.
    console.log('Successfully created new user:', userRecord.uid);
  })
  .catch(function(error) {
    console.log('Error creating new user:', error);
  });

The client will call the cloud function with their desired email and password, and before calling this .createUser, and you can check for the correct email before creating the user with "dog@cat.com".toLowerCase().endsWith("cat.com").

Alternatively, you can set a custom claim for users as mentioned by @frunkad: Give extra permissions to users who register with "@cat.com" emails, and this is shown here: Defining roles via Firebase Functions on user creation. However, in OP's case, only users with "@cat.com" should be able to register, so custom claims are over-complicating the issue.

Also, using email domain as a form of access control doesn't sound like a good idea. During the account creation process, you manually add access to the user's document based on the email. What happens when you want to give someone an email but don't want to give them access to the database?

In your firebase security rules just paste this

this works for me and I am able to restrict logged in Google user to my org domain

rules_version = '2';
service cloud.firestore {
  match /databases/{database}/documents {
    match /{document=**} {
      allow read, write: if request.auth.token.email.matches('.*@domain[.]com');
    }
  }
}

As of August 2022, you can write blocking functions that can stop a user from creating an account if some requirements are not met. The linked documentation specifically shows this example:

export const beforecreated = beforeUserCreated((event) => {
  const user = event.data;
  // (If the user is authenticating within a tenant context, the tenant ID can be determined from
  // user.tenantId or from event.resource, e.g. 'projects/project-id/tenant/tenant-id-1')

  // Only users of a specific domain can sign up.
  if (user?.email?.includes('@acme.com')) {
    throw new HttpsError('invalid-argument', "Unauthorized email");
  }
});

Use of blocking functions requires that you use Firebase Authentication with Identity Platform.