Comment by BehindTheMath

You don't need mTLS for that. Just block all IPs beside for Cloudflare's ranges.