I've been using a compute-engine to host a website on gcloud. I just can't figure out how to make access to the project private, with a whitelist for pre-approved emails.
Developing the above answer:
The Identity-Aware Proxy will allow you to Use identity and context to guard access to your applications and VMs.
If you just want to allow specific users to access your website there are some alternatives:
Install a plugin to restrict access, for example this one.
Restrict GCP Instance's traffic access through Firewall rules. This is not recommended because you will need fixed IP addresses for the users, or they should use a VPN to always connect from same fixed IP address.
By doing this the website will still be publicly available but only allowed users could access the website and modify it or access private content of the website.