Need to connect bidirectionally ( connection can start in each direction ) from EC2s on VPC to on prem servers, with certain restrictions.

Hello.

I think the following two statements are contradictory.
Why go to the trouble of connecting your VPC and on-premises with DirectConnect's private VIF, but do you need to use public IP space?
If you connect with DirectConnect, on-premises and VPC can communicate.
I don't think there is a need for a public IP address.

• Public address space need to be used on all flows
• Connection need to be done using Direct Connect using Private VIFs