Create a VPC Service Controls perimeter that includes the VPC network, and designate Dataflow, Cloud Storage, and BigQuery as permitted services within this perimeter. Deploy Dataflow using only internal IP addresses.

Enable Private Google Access in the subnetwork. Deploy Dataflow using only internal IP addresses.

Configure firewall rules to permit access to Cloud Storage and BigQuery. Deploy Dataflow using only internal IP addresses.

Assign network tags to your workers to allow access to Cloud Storage and BigQuery. Deploy Dataflow using only internal IP addresses.