Is there really no way to only have one production domain on Vercel?

Wow, firewall sounds like a really simple solution, compared to what I have in place — authentication with Clerk that allows only my custom domain.