Hi Reza thanks for sharing you insightful information and I do agree with you. Yes I do encourage people and customer to run phishing campaign which refer to your junk email suggestion. I've seen improvement running phishing comping and educating employees. There are many 3rd party tools available but the good thing is that now M365 do also have this tool freely available. Not sure if you have seen it or now but I'd highly recommend it and there are different types of campaign available.
Now going back to the blocking the countries, blocking IP addresses is good but never ending and this is where you need more than one approach. So blocking countries applies to those companies who needs to meet compliance specially in US and UK/EU. US has some regulation where certain countries are blocked. In Azure you can leverage blocked countries option which automatically take cares of that. Moreover when attackers comes from malicious IP addresses AZURE AI and ML take cares of that but of course they may not be accurate all the time but I've found it good so far.
Feel free share your thoughts and anything you have seen and improved protection your/customers environment.
Thank you again
Adnan @iMentorCloud