I've been doing freelance to create an altcoin and my client wants this new coin to be private which means only authorized users can mine and use the coin. What I've been doing so far is to make a new altcoin, keep it in a private repo
Bitcoin sounds like a poor fit for your application for two reasons. First, Bitcoin is designed to keep working even if some people tamper with the inner workings of their client. If you're willing to give that up, you can build something a lot simpler. Second, it's designed to process transactions in a decentralized way, which sounds like the opposite of what you want. If you give that up, and use a central clearinghouse, you can build something much simpler.
So I was wondering how could someone get my code and whether he was able to mine my altcoin.
I don't know whether this person has the source code of your altcoin; I don't know what security measures you've taken. However, having the source code of your altcoin is not nessesary to connect to it. As long as a peer can fake its way through a version message, that's good enough to make it into getpeerinfo. The two clients don't need to be running the same code.
And do you have any ideas or suggestions on how I can stop someone from mining my altcoin or only allow certain machines from certain IP addresses can connect to my network and mine even if they have my altcoin source code?
Bitcoin's design is going to make that quite difficult. Bitcoin uses a gossip network to move blocks around. If I mine a block, and I tell you about it, then you will tell all of your friends about it. They will in turn tell all of their friends about it too, until everyone knows.
This means that if a single node is misconfigured, and allows external blocks, it broadcasts those to every other node on the network.
It would make more sense to modify the client so that blocks must be signed by a key that is only held by your client.
