I noticed that when deploying the Gitea workspace service inside my workspace that it is accessible outside of the virtual desktops. Changing the networking settings in the Azure portal for the app service so that public network access is disabled resolves this and causes a 403 to be returned, while still remaining accessible from within the desktops.
@scott4589 thanks for raising this. This should have an is_exposed_externally as per some of the other services.