Hello Rachel,
IP Address ranges will never work reliably for countries, as there are no specific assignments that are used exclusively by specific countries. This is especial true as we live in a hosted world today, where a domain may not be hosted in the country it is target for. So you are left with filtering top level domains only, an efficient approach would be to create two incoming mail policies, and a content filter with no conditions, and a single action "Bounce", or "Drop".
The first of the mail policies would be your exception list, where you add all the recipients of your staff that you want to exclude from the country blocking policy. Enable all services there such as antivirus and antispam.
In the second policy add the top level domain you want to use as sender, in the form of:
@.tld
In this policy, disable all services and filters, and only enable the Bounce or Drop filter you have created before (and enable it in that policy only).
Make sure the exception policy is placed before the TLD policy. You want to use policy in order to enable mail splintering, i.e. if a message from such a TLD contains multiple recipient of users you want to except, and normal users. A filter matching on one of these would either block the message for all recipients, or deliver it to all recipients, thus violate the policy.
Hope that helps,
Andreas
