You don't need mTLS for that. Just block all IPs beside for Cloudflare's ranges.