Generally the default config has unrestricted access for everyone
Allow from all
Then you must force authentication for your restricted area by denying all, then allowing just those subnets, followed by any requirements for how they actually would authenticate. Satisfy all is used to insure both policies of access are required.
Deny from all
Allow from 18.104.22.168/15
Allow from 22.214.171.124/15
AuthName "Restricted Area"
Every single time I think I understand the rules for how authentication works, I have to futz with the config repeatedly until I get some nuance correct. Use this only as a starting point. Re-read the apache documentation on mod_auth and mod_access in particular, paying special attention to the Order directive. Therein lies your answer.
Hope this helps, and please post your working example if it doesn't match this one, as this is a pretty good recipe to have in an apache cookbook.
Testing the above shows that restricted area is forbidden to all except for those from the IP address, who must provide authentication.
It is not clear from your question if users from other IPs need unfettered access to this 'restricted area' or if they are simply forbidden?