A bit of a quick side story: A bank I worked for set up a lock for all business sites on their firewalls and WAF for any IP geolocalized as Russian. It just dropped or rejected all network packets completely. Individuals could still use their service, though.

It was like that since at least a decade ago, since original Russian attack on Ukraine and I have not heard of any issues they run into with that approach.

The just went "no".