When you start any server which listen to some port, you need also choose to which network interface it should do bind. There is at least two network interfaces on your machine right now: a ethernet/wireless interface, and a loopback interface. Each interface has an IP address: probably your ethernet/wireless interface has address similar to
192.168.0.42 (two last numbers can be different). In contrast, loopback interface always has an IP address
127.0.0.1. This is by convention.
Loopback interface is special. It literally means "connect to host itself, from host itself".
When your server binds to ethernet/wireless interface, it can accept connections from any device in network it connected to. But when server binds to loopback interface, it can accept connections only from host itself.
So all you need to do in order to prevent other people from connecting to your host serving your app is to configure server to bind only to loopback interface -
127.0.0.1. You need to check express documentation to find out how to do that.
The server also can be bound to
0.0.0.0 IP address, which literally means "listen on all available interfaces".
Yes, other people can scan network and see other machine's IP addresses. Next, they can scan each machine ports to see which is opened (there is only 65536 possible ports). But, they probably can't know that particular machine is yours - there is no such information available by scanning. They can use other heuristics to gather more info about each machine, (for example, they can guess OS type fairly accurate). But all of this is indirect information.