Lock XG device access to a specific country

Not answer to question. Assume you allow HTTPS in Device Access for WAN. When you do that, I believe that just connects you directly to the XG.

An alternative way of connecting and that is to use SSL VPN. Which would then be a secure connection 'tied down' to a user.

I'd advise against this however it is possible see the bottom of the page of the link below, you should be able to set the source to your country

+1 for kieran90 Here's the direct link to that section for the lazy.

Deny HTTPS on your WAN zone

Then create an exception rule with the source set to the country object, the destination as your XG's WAN Public IP, and the service set to HTTPS.

Regards,