The NetworkPolicy API spec includes namespace selectors in policy rules, which apply before the Pod selectors.
You'll need to include the namespace in both ingress and egress rules.
The existing policies do something similar already for accesss to the DNS server.
Need more? Here's the solution.