Yes, you can restrict access to the database to the Strapi application only and your IP address(es) if required.
How? Depends on your hosting solution. If you’re using AWS, Google Cloud, or Azure there are plenty of solutions online on how to lock down your database to an application or restricted within a Virtual Private Cloud (VPC).
If you’re using an alternative method of hosting, the community might be able to help but you’re starting to get into more intermediate and advanced topics.
constantly picking up passwords 24/7
Sad as it is to say, welcome to the Internet. Every website, service, server, IP Address and device on the Internet is being scanned for vulnerabilities.