Use a ‘Firewall Rule’ and match on both ip.geoip.country (RU, CN etc.) and the internal Cloudflare param cf.client.bot (which is true for bots and false for non-bots).
i.e to block only non-bots from Russia and China whilst allowing their bots:
(http.request.method eq "GET" and ip.geoip.country in {"RU" "CN"} and not cf.client.bot)
Yeah, looks perfect. I’m in Australia so if you like you could temporarily add that country and send me your domain name and I’ll post you a screenshot of my access attempt just so you have proof it’s working?