I am able to make work the backend service as an instance group - if i enable the "Allow http access" enabled while creating the members in the instance group.
However i want to disable this and make the network work only from the loadbalancer(external ip). However it is not working. The way I did was to define a firewall rule in the subnet where the instance group is there, such that the destination is the network tags defined for the instance group members
the source is dfined as the ip of the load balancer as a range.