single user only allowed to connect from specific IP

Using a recent ejabberd version, it is possible to put ACL definitions inside Access definitions, which in practice allows this and may work as you want. Try this:

listen:
  - 
    port: 5222
    module: ejabberd_c2s
    access: c2s
    ...

access_rules:
  c2s:
    - allow:
      - user: "foo.bar@example.org"
      - ip: "127.0.0.1/8"
    - deny:
      - user: "foo.bar@example.org"
    - deny: blocked
    - allow
...

Using a recent ejabberd version, it is possible to put ACL definitions inside Access definitions, which in practice allows this and may work as you want. Try this:

listen:
  - 
    port: 5222
    module: ejabberd_c2s
    access: c2s
    ...

access_rules:
  c2s:
    - allow:
      - user: "foo.bar@example.org"
      - ip: "127.0.0.1/8"
    - deny:
      - user: "foo.bar@example.org"
    - deny: blocked
    - allow
...

@badlop :

Thank You very much!

working like a charm, now login attempts to foo.bar@example.org from different IP is blocked,
return code is: