A new edge rule kind, asn, allows or blocks every address of an autonomous system: {"kind": "asn", "asn": 64500, "action": "block"}. Each edge node looks the client's ASN up in its local database; an address whose ASN is unknown never matches. Within your zone's rules, and then within the platform's, an ASN rule decides before a country rule, and an IP allow rule skips both. Blocked requests appear in the security events as ASN Block.
Add them in Security → Firewall → Rules → Autonomous systems (ASN), with POST /v1/orgs/{org}/zones/{zone}/rules or the batch route, rules add <zone> kind=asn asn=64500 action=block in the CLI, or add_rule and apply_rules_batch in MCP.