I will suggest starting by solving it with IP whitelisting in your webhook service. The IPs you need to allow for communication between Marketing Cloud and your endpoint depend on the stack on which your MC resides.
You can find all the IP addresses on this page, under Instance-Specific IP Addresses. For example, if your instance resides on stack 6, you should allow your endpoint to receive traffic from following IP adresses:
You should also have a look at this sequence diagram explaining the process of integrating MC with your endpoint (source):
As described in the documentation all the callbacks are signed, and can be validated by looking at their HMAC-SHA256 signature.
Combining both IP whitelisting and signing, will ensure you only accept valid calls to your endpoint.