Protect AWS Appsync APIs end point from public internet, restrict it to be accessible from Service deployed inside vpc

For your particular use case, the most straightforward option would be to use AWS_IAM authorization:

• create a role, allowing appsync:GraphQL action on the GraphQL API resource (or subset of operations)
• associate backend service with that role, so that it can sign all GraphQL requests with SigV4
• configure GraphQL API to use AWS_IAM security

This will require all clients to attach a valid SigV4 signature to all client requests.

If you want to lockdown API endpoint access even further and reject connection requests from unauthorized ip ranges, you might want to consider adding WAF integration and building WAF rules to allow connections from a predefined ip address range only.