NFC TAG scan only in local network

Hello community!

I have a homeassistant installation in a docker container up and running and I have written and added some NFC tags. These tags can trigger automations about my Android companion app. So far everything works fine.
Now my problem. For some tags outside my house I want to add a condition that the mobile with the triggering companion app has to be in the wifi at home.
Why do I want that? For security reason. Somebody could copy the tag and could provide the copied one to my phone connected to home through VPN when I am somewhere in the world.

It would be great if somebody could give me an example how to add such a condition to an automation so that every user with its companion app can use the nfc tag only when connected to the home wifi.

Thank you!!!