The firewall will always return a 403 when a request is blocked and that’s the correct status code.
If you want to return a custom code, you would either have to implement this yourself (Worker or server-side) or - alternatively - you could use a URL rewriting rule instead of a firewall rule and rewrite requests to a path which returns such a code.
I would not advise any of that, however, as 403 is the correct status code. If you really want to go that route, the best approach would be to simply handle that server-side.