You can have simple DENY for inbound TCP connections, because you can simply block incoming SYN packets. But inbound stateless DENY can't deal with UDP, as there is no connection.

So your options are either to prohibit UDP (goodbye QUIC) or to have stateful tracking.