you can do this using the Server validations.
Select File extension validation, click the lightning bolt next to server variable and select the File field extension variable from the form binding group. When you add the file extensin validation, you will be prompted for extensions you wish to allow.