Is it possible to limit RMI server access to a list of hostnames/ips or to localhost only?

Sure, just design it into your system. When the client request comes in, look up the incoming IP address and check your list of accepted IP's. A similar topic using discussing limiting the number of connections to an RMI server can be found here: http://www.jguru.com/jguru/faq/view.jsp?EID=79317.