Cloud itself doesn't enforce any time or location restrictions. However, if you use an SSO integration, you have the opportunity to disallow authentication based on whatever criteria you like. So in your case you could have your ADFS server only allow authentication for requests from the internal network.