Establish an IP access control group rule listing the public addresses of the branch offices and associate this group with the WorkSpaces directory.

Employ AWS Firewall Manager to create a web ACL rule incorporating an IPSet of the public addresses from the branch office locations, and link this ACL to the WorkSpaces directory.

Utilize AWS Certificate Manager (ACM) to issue trusted device certificates to the machines at the branch office locations and enable restricted access on the WorkSpaces directory.

Develop a custom WorkSpace image with Windows Firewall configured to limit access to the public addresses of the branch offices and deploy the WorkSpaces using this image.