For page-level restriction, a CDN/proxy or internal hosting approach would be needed.
Simply putting a CDN or reverse proxy in front of Marketo won’t work: you’ll end up getting rate-limited by Cloudflare.
And even before you get to rate limiting, if someone knows your Munchkin ID — which everyone does — they can just go around the CDN and straight to Cloudflare.
Marketo’s not the place for truly secure landing pages. That said, we do have some LPs that are intended to be non-discoverable. We use an unguessable GUID as the page name, like pages.example.com/4997864b-1918-40af-95d0-652a51ca7ec6. But you can’t count on this never leaking to the public, and if someone who knew the GUID leaves your company you must change it immediately. So that’s probably OK for, say, a li’l UTM builder app that you host in Marketo, since it doesn’t have truly secret info.