geoblock on palo alto

The FW needs to see the IP before geoblock can be applied 

under monitor > logs > GlobalProtect

( stage eq 'login' ) and ( status eq 'success' )

Also

Network > Gateways, click on the "Remote Users" link on the right

There is also the option to create the NAT for the GP IP only for the geo locations allowed

Have a general security rules with geoblock to/from any deny

Have a security rule to allow access to the GP IP only from the approved countries

Set the countries up in the GP config (portal / gateway)

Config the geoblock on any 2FA you might be using for 2FA as well as another line of defence

Enable the palo EDL blocks and dynamic threats etc, strict IPS

***

GP allow initial connections IP connections 

can geoblock here IE (but be careful about your S2S VPNs, maybe make a rule to all S2S peer IPs) 

outside > OUTSIDE 

D:x.x.x.x (GP public IP)

UDP 500

UDP 4500

UDP 4501

GP allow IE users

outside to outside

D:x.x.x.x (GP public IP)

apps

ike

ipsec-esp

ipsec-espudp

panos-global-protect

ssl

web-browsing

Block everything else

outside to outside

D:x.x.x.x (GP public IP)

any any deny