Take wiht a bit (or a lot) of salt what I am gonna say. Because undoubtedly I am. Missing something here.

But if what you a already say is true probably you are not restricting anything. The recommended way to do so is with a firewall rule (probably in your router).

You are extending the subnet definition beyond the 16 bits. This can create problems and I doubt that your router will block anything if something crafted is received from Internet.

But of course, being the extremely big address space your are probably safe.

I any case, with a firewall rule in your router allowing only the proxy to go receive connections, you should be good and more standard conform