My understanding is correct. If you only allow CF IP to return, using allow Cloudflare IP and deny everything will be enough. However, if you want to block a specific IP from accessing the website, denying an IP is meaningless. My understanding is correct.