A tied down Permit All Origins : Permit Only Certain Origins?

[Bucking_Horn]

As mentioned by rdwebdesign, it is quite possible to use native dnsmasq options for customisation:

@Bucking_Horn

As a tailored fork of dnsmasq, pihole-FTL would allow you to exercise exact control of its binding and listening behaviour as detailed by dnsmasq documentation, see specifically its interface, listen-address and bind-interfaces options (among others).

To apply them, you'd need to configure Pi-hole to not manage interface listening behaviour at all, by switching dns.listeningMode to NONE

If you wouldn't be able to configure what you want to achieve with existing dnsmasq options, you'd probably need to file a feature request with dnsmasq.