Limiting access to heroku app
As is, heroku doesn't allow for the removal of the herokuapp.com domain for an app. However, they advise that if access to the app must exclusively be via a custom domain, then requests to the herokuapp.com destination could be redirected (301 redirect) to your custom domain URL.
It's mentioned in this note: