if I play the game Singleplayer I don't want to leave anything exposed to the internet while only playing locally
That is usually not a problem, because usually the LAN is behind a NAT installed by the ISP. Such that you actually do not have an public IP to which other can connect... instead everybody outside your LAN sees the router/gateway IP.
Is there any way to limit the "range" of the server to only let communication happen via LAN?
What you want is a subnet mask. All the IPs in the same network will match within the mask... to put it another way, the subnet mask defines up to what point IPs in the same network are equal.
The server can be programmed to use the subnet mask to compare its IP with the origin IP and allow or deny connections based on that. See Test with Java if two IPs are in the same network.
In the odd case where you cannot※ get mask programmatically, you can always let the user specify as part of server configuration.
You may, of course, use a whitelist of IPs, or a simple ACL.
※: I'm not familiar with Kryonet or whatever or not it will filter by subnet out of the box, so I looked it up, and found this:
// Java 1.5 doesn't support getting the subnet mask