Are looking to manage a list of IPs that are blocked by your OnPremises Firewall in Sentinel or do you want a Remediation Action to write IPs that you find to be Suspicios through Hunting on demand?
Either way, if you do not want to expose your Firewall to the internet your firewall vendor will either have to support REST API Calls originating from the Firewall or you need an API that is Accessible from OnPremises and a Hybrid Worker - Here is an Article by John Joyner about what I think you want to achieve -
https://blog.johnjoyner.net/azure-sentinel-soar-worker-azure-arc-azure-automation/
