How can I stop users from directly connecting to the OC4J and force them to come through the Oracle HTTP server ?

oc4j httpserver oas

You can set access mask for a web application by making changes in the orion-web.xml for your web application to allow access to a particular host or IP address where your Oracle HTTP Server is running. For example you want to allow access only from host named dpanda-us and machine with IP address 192.168.1.100 you have to add the following in the orion-web.xml: 

<access-mask default="deny">
<host-access domain="dpanda-us" mode="allow" />
<ip-access ip="192.168.1.100" mode="allow" />
</access-mask>

In OracleAS, OC4J and Oracle HTTP Server are tightly integrated with mod_oc4j and access control can be specified and enforced at the Oracle HTTP Server level.