@Chris *******
Yes, certainly this is one way! But the end run to all the above can be ignored by using routing traces. Most often using flat tables of preidentified device origins. Though VPNs can impersonate a regions IP address it cannot mask the routing coming from outside of a designated area.
I used to restrict access to infrastructure, sites and services to only the US 48 contagious states for an entire organization, VPN or not. Tools used would not only allow for restriction based on IP and subnets, they would identify the geographic origin of the request. Frankly pretty slick stuff!