So you want one application to disallow all connections, but others can receive incoming requests? Why not just un-deploy the application you don't want to be accessible?
I have tried to do it with the Security Manager (SocketPermission), but it doesn't restrict all incoming connections.
Really? You must have done it incorrectly, because disabling SocketPermission should have prevented Tomcat from binding to the port in the first place. No connection would be possible at all. Note that you need to enable a SecurityManager in order to use SockerPermission, and that Tomcat's default security configuration is to allow the appropriate SocketPermissions, so you'd have to seriously damage your Tomcat installation in order to do that. I don't recommend it.
And also I have tried with RemoteAddrValve and RemoteHostValve () but it restricts all connections, not only the incoming ones.
What other kinds of connections are there, other than incoming ones?
I have been searching other way to do that but I couldn't find anything.
You haven't really described what you want to accomplish. "Restrict incoming connections per application" could mean a range of things. Do you want to prohibit certain connections (e.g. non-localhost), throttle connection rates, or require authentication for certain applications?