always use firewall to block ip/cidr or country.
like hardware firewall with your hosting provider or local software firewall installation like CSF Firewall. NEVER use http/webserver app.
in CSF Firewall you just enter this:
CC_DENY = "CN,IN,VN,PK,KP,KR,HK,RU,BY,UA,SG,BR"
install ipset module to keep millions ips in iptables without any performance degradation. enable it:
LF_IPSET = "1"
then enable blocklist, it will ban every bad ip from honeypots list with weekly updates:
sed -i "/|0|/s/^#//g" /etc/csf/csf.blocklists
then also it has lots of features to enable traffic and connections tracking, and will ban any ip that opens more connections than you define. etc
you will have to check with your services and modules if they use their API or connections in/to blocked countries. and whitelist their networks.