There should be an option to bind the WebSocket server to a specific interface/ip, equivalent to what the ‘–http-listen’ parameter does for the deCONZ webserver. The implementation should be trivial.
On a side note, moving feature requests to Discourse is a bad idea IMO. Writing a patch for deCONZ together with this feature request would have been trivial. By moving feature requests away from the codebase you are discouraging users from contributing code.