CSF port limitation to a single country

I have a specific setup that CSF needs to be compliant with but no idea how to properly make it. I need port 25.80.443, accessible only from within one country. I do not want users from anywhere else in the world to access it. Thus, I set up a TCP_IN for 25.80.443 and CC_ALLOW_FILTER=“MY” CC_ALLOW_PORTS=“465.587.110.143.995.993”. However, ports 587 and 465 allow access to users outside of the country I wish to operate with. Might any forum members know the trick?