I’ve moved this into a new topic as that had been answered and dealt with a slightly different need.
You, you can craft a Firewall Rule to block certain user-agents, but it’s not advisable to “allow all except…”. In the context of a Firewall/WAF Rule, allow is an action that would let the triggering request to bypass any subsequent firewall rule. Instead, simply use the Block or Managed Challenge action with an expression that matches your bad visitors.
You can list a bunch of UAs with the is in operator. I hope that solves your issue.
Make sure you also familiarize yourself with specialized tools like Bot Fight Mode (available on all plans), Super Bot Fight Mode (available on paid plans) and Bot Management (Enterprise plan).