> Btw, doesn't blocking by IP address go beyond what is required by law, since only Iranian residents are subject to sanctions?

The penalties for violating sanctions are so severe that it is worth the risk of potentially blocking legitimate customers.

> Would preemptively restricting accounts that have logged in from an Iranian IP address and asking for proof of residence break the law?

It would be extremely expensive and in a literal sense not worth the time.