(Top-posting corrected.  You're welcome.)

...

Does Jetty let you use, say, Apache HTTP Server in front of it, as Tomcat does
(typically via the AJP connector)?

Apache HTTP Server has directives for that sort of thing.
<http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#allow>
<http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html#deny>

For this, a suitable user login and authentication mechanism is a good
solution. I assume this is for your LAN or a VPN-tunnel-based WAN, in
which case, stick it behind the corporate firewall and use password-
based authentication. What if an authorized person wants to access
this service from other than his usual location for whatever reason --
or an unauthorized person gets physical access to one of the machines
you'd be whitelisting?

Also ask what the purpose of the access restrictions is. If it's for
crass commercial reasons then I won't be very sympathetic, although if
it's to keep confidential information confidential, like patient
records or financial data or credit-card numbers or what-have-you,
then it's another story. It may be the case that the restrictions are
gratuitous or unnecessary to carrying out your primary purpose and
will just inconvenience or cost people needlessly (e.g. if it costs
very little in resources per access and organization-wide access would
do no harm and might benefit some people, but it's going to be
restricted to a subset of the organization, or people will have to pay
for access). If the restrictions are absolutely necessary,
particularly for security of confidential data or trade secrets or
something, though, figure out who needs access and set up a system
with user or group accounts and passwords.

My, my, with this newsgroup's regulars the fun and sarcasm never
stops!

I never said anything about using bitmapped image based captchas.
There are other kinds, such as verbal math problem captchas, that
avoid the accessibility problems. Also there's the target-audience
factor. If the page is meant to be used by, say, a bunch of US Marines
sharpshooters, or fighter pilots, I doubt they'll have problems with
bitmap captchas. :)