You will need to proxy the records first, make sure your SSL/TLS setting is set to “Full (strict)” and check your site functions correctly.
Once that is done you can create custom WAF rules in Cloudflare to block or challenge as you need. In the case of the Huawei Cloud, you can block/challenge AS136907 and take if from there.