I have a VM running at GCP and want to access this VM with my firebase function via express.

Now the VM has a public IP, I would like to set the firewall of the VM so that only traffic from the firebase cloud function can access the resource.

Is there a specific address space that firebase cloud functions use?
How should I set up my VM firewall so that only “internal” traffic can access the VM?
Or is this only possible with VPC?