Yes, you can do that. Please see section 4.4.3 "Cluster Membership" from the Guide, on page 50 -- it explains how to set hosts to connect to and hosts to prohibit connections from.

Cryptomove does not require UDP.