Let me separate this into two questions:
1 - Should you do what your boss tells you?
In the end, they are paying you to do work. Take the money and do the work, or don't take the money and don't do the work. What he's asking for is not unethical or immoral, it's just unwise.
Most folks won't quit over one stupid order, but if you really have no faith in the command structure and it's ability to do smart things, then figure out how much that matters to you in terms of general job satisfaction and also whether or not you can take steps to change it.
2 - In a knowledge working position is it acceptable to question the management?
Yes - absolutely.
Different jobs work differently here - for example, if you were in an industry that centered around rapid response (say, the military, or in an ER), then questioning the boss under time-critical conditions may be an absolute no-go.
But in knowledge working, it's generally assumed that individual contributors have advanced skills and training and will be making independent choices. When a directive from management goes against the good sense of your more detailed knowledge, it's fair to question the directive and raise counter points.
The key here is usually that you won't get far with flat out negation, instead, look into alternate strategies and suggest a path that gets the objective done, but in a better way. And put together ammunition that is worded in business-related concepts, not technical ones. In this example, in particular, I happen to agree with you - I've seen IP locking implemented and it's induced a lot of pain and suffering. But the point that the boss has of no-remote-access is a fair one from a security/business risk perspective.
So, I'd start with this process:
Does your boss or the big boss understand that you may accomplish very little with IP locking? For example:
- do people take their laptops home? Can the files be uploaded at work to the laptop and then brought home?
- does the portal itself have limitations so that data viewed on the portal can't be copied to a laptop/desktop?
Rather than the technical angle, phrase your concerns in a person-centric way - for example, if I was the user and I wanted to work on a report late at night, I'd copy the data from the portal to my laptop and then work from home on my laptop after the kids go to bed... is that feasible here?
Is this covered in other parts of the business? To what lengths does the big boss want to take these security measures? Chances are really controlling this will be more expensive than he really wants...
Clarify the ramifications in terms non-tech folks can understand
I suspect that the reason you dislike this solution is:
hard to administrate -> means that users will have more trouble logging in the first time, and any changes in the at-work system could cause outage when users suddenly can't connect - in terms of the business, this could mean big delays in satisfying customer needs.
expensive (sometimes) - is there a cost in terms of equipment licensing or other features? Money is something business users understand. Also factor in time to administrate - paying for your time while you do maintenance instead of other things.
Offer something better
Come up with a better option that gives the boss what he really needs at a lower price than this option. It's hard to argue when you are getting what you want. Don't deny that there is a business concern or risk - this is where the boss probably does know best. But find a better strategy and then find a way to explain in non-tech why it is better.