Follow-up in case the scenario is something like "I want Forms to be external and Repository Web client to be internal" rather than "I want multiple instances of $app".

Still don't do that. Use a separate VM for separation of security concerns.

Alternatively, use a layer 7 http reverse proxy/load balancer that supports path-based routing to provide the external endpoint, and add routing rules that only allow access to a specific app like so (pseudo-code):

# Routing rules processed in sequential order until match found

# block /FormsConfig access - must be first to take priority over /Forms* rule
1. if (host = external.example.com & path = /FormsConfig*) {return 404} 

# allow /Forms traffic
2. if (host = external.example.com & path = /Forms*) {route to $webServerBackend} 

# allow login page access if necessary
3.  if (host = external.example.com & path = /LFDSSTS/*) {route to $webServerBackend} 

# default/fallback rule
4. else {return 404}

-Sam