I suggest having your setup as a deny-first approach. Meaning denying every IP and whitelist the known few, Traefik offers a middleware for this.

Alternatively you can blacklist by country of origin however VPN’s are a thing, I would only recommend this on low-risk applications such as Invidious instances, dashboards and such.