How can I block IP addresses that are attacking (according to my online store provider) the filters in my store, apart from using a firewall (which appears to be available only in the enterprise plan, which I don’t need at all)?
Only the account-wide WAF requires an Enterprise plan. You will find WAF and bot protection settings under “Security” in the menu under each of your domains in the Cloudflare dashboard for all plans.