node js allow access only from frontend

I'm trying to allow access only from my frontend and to restrict all others access from direct URL on API/postman and other things. I saw some examples here but I couldn't solve this thing.. This is my currently app.js:

const fs = require('fs');
const path = require('path');

const express = require('express');
const bodyParser = require('body-parser');
const mongoose = require('mongoose');

const companiesRoutes = require('./routes/companies-routes');
const usersRoutes = require('./routes/users-routes');
const adsRoutes = require('./routes/ads-routes');
const HttpError = require('./models/http-error');

const app = express();
const http = require('http').Server(app);
const io = require('socket.io')(http);

app.use(bodyParser.json());

const cors = require('cors');
const corsOptions ={
  origin:'http://localhost:3000', 
  credentials:true,          
  optionSuccessStatus:200
}

app.use('/uploads/images', express.static(path.join('uploads', 'images')));
app.use('/uploads/videos', express.static(path.join('uploads', 'videos')));
app.use('/uploads/videos/thumb', express.static(path.join('uploads', 'videos/thumb')));

app.use((req, res, next) => {
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader(
    'Access-Control-Allow-Headers',
    'Origin, X-Requested-With, Content-Type, Accept, Authorization'
  );
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, PUT');
  next();
});

app.use('/api/companies', companiesRoutes);
app.use('/api/users', usersRoutes);
app.use('/api/ads', adsRoutes);

app.use(cors(corsOptions))

app.use((req, res, next) => {
  const error = new HttpError('Could not find this route.', 404);
  throw error;
});

app.use((error, req, res, next) => {
  if (req.file) {
    fs.unlink(req.file.path, err => {
      console.log(err);
    });
  }
  if (res.headerSent) {
    return next(error);
  }
  res.status(error.code || 500);
  res.json({ message: error.message || 'An unknown error occurred!' });
});

and last mongoose.connect etc.

Maybe I did something wrong here but I cant realize where's the problem in this code. I got this example about CORS here from other topic but it didn't solve my problem.