As with any IP server you can control which interfaces/addresses the server binds to (listens on).
So if you only want clients on the same host as the broker to be able to connect then you just have the broker bind to 127.0.0.1 rather than to 0.0.0.0 (this is a shortcut to bind to all local interfaces)
Nothing, as I stated in the answer on Stack Overflow they are byte for byte exactly the same protocol, it's just the transport layer which changes from raw TCP to Websockets.
The difference is that you CAN NOT open raw sockets from within the browser, the security sandbox will not allow you to open arbitrary TCP connections to random hosts. The sandbox will ...
First, if you just have 1 garage door opener, why are you generating a random client id every time? using a fixed clientID would be the right thing to do here.
The only time a random clientID makes any sense is when you are using a transient client e.g. a webpage using MQTT over Websockets.
Second, you appear to be double looping your reconnect function. ...