Web Application Security (Set of users)

I have a spring MVC web application hosted at cloud. I want to restrict that web application to specific group of users. What is the best way to do this?

Few things which I tried are

1. Trying to bind the request to MAC address. Which is not possible for all browsers.


2. IP restriction in tomcat but it will have static IP addresses and user have dynamic IP's. Which is not feasible to do.

I have another idea but not sure how to do it. I want to create a app which will run on the user's system and without which he will not be able to connect to web application.

Any other suggestions are also helpful.