How do you block unwanted ip's in sys-net in the best way?

Yeah if you want to block ip’s in sys-net, that’s disposable… do you add them in firewall every time, or can you block them in other areas of Qubes? How do you block fastly and other services in the best way in Qubes?