[Dovecot] Restricting access to imap ?

Is there a way to restrict access to imap on a per-user basis ? Situation is as following : internal server w/many users, some users work also from home. I would like to make their mailboxes accessible from outside via imaps, but only for selected users with strong passwords. If dovecot would run via inetd, I could use hosts.allow patterns for this. Any idea or is this just not possible ? (I know the easiest way would be to connect via VPN but thst is not possible at the moment).

Yours, Jakob Curdes