You can do that! You just have to block known cloud service providers, known scraper ASNs, and while this is not at the firewall level, a captcha or other challenge like cloudflare or anubis.