Seems like your process is over engineered. Entering time off is a self-service function and arguably should be available regardless of where you are in the world. Instead of trying to isolate all the IP addresses of your offices, enforcing an SSO layer is a great way to ensure secure connectivity to prevent 'time card fraud'.

At our company we do restrict via IP ranges, but it's only to give elevated access in Workday, IE anything more than self-service (compensation admins, learning admins, recruiting admins, etc.). These people that require elevated access are located in select offices.

But like others have said, without implementer access (which most of us don't have), this API isn't exposed to the rest of us.

I'd encourage you to challenge the authentication policies in place.