How can I restrict access to a file on OSS while still allowing download using wget or curl

I have created a large file (disk image) on OSS. I am able to download it with a browser using a hotlink (temporary time limited url). However I am unable to download to another server using wget and curl with the same url (error 403): "you have no right to access this object because of bucket acl".

In this answer: stop oss links from expiring it is stated that setting public or public-read ACL on the object or bucket is the only way to do this. If I do make it public, can I also set up whitelisting for the destination server to prevent others from downloading the file?

Based on this doc, you can use IP based bucket policy to restrict the access from certain IP addresses.