How do you restrict specific countries from reaching/connecting/anything on an XG Firewall?

It is better to create a country specific DNAT blackhole rule as Firewall rules do not take precedence over system rules. So smtp and waf traffic will not be blocked by a firewall rule.

https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/tasks/CreateBlackholeDNATRule.html

Thanks Fred,  i guess im just a bit miffed about this since Ive grown accustomed to the ease of use of UTM 9.x, but ill give the Blackhole DNAT a shot, since there are no logs coming off the firewall rule i generated, so i cant verify, the only way i think i can say it is currently working is tried to access the firewall from a Bahamas IP address, and had it in the WAN > ANY > FROM: Bahamas rule, and couldnt access it, i have no Local ACL on the XG in Device Access either, so perhaps it is working, but it just doesnt tell you anything as to whether it is like the UTM would.  

Thank you both for you inpu Fred_B and

Thanks Fred,  i guess im just a bit miffed about this since Ive grown accustomed to the ease of use of UTM 9.x, but ill give the Blackhole DNAT a shot, since there are no logs coming off the firewall rule i generated, so i cant verify, the only way i think i can say it is currently working is tried to access the firewall from a Bahamas IP address, and had it in the WAN > ANY > FROM: Bahamas rule, and couldnt access it, i have no Local ACL on the XG in Device Access either, so perhaps it is working, but it just doesnt tell you anything as to whether it is like the UTM would.  

Thank you both for you inpu Fred_B and

As the firewall rule is not logging anything (logging enabled in the rule) and you see no hits than I assume it is a system rule that takes precedence. 

The blackhole DNAT and NAT rule will give you allowed results in the log but their endstation is a blackhole.