@arivadeneira There is no option to block users based on destination IPs.

The only available options are to create policies based on Source IP, Source Country, and Destination Country.
You could submit this as a new feature request from the 'Feedback' section on your tenant UI.

@arivadeneira you are talking about Microsoft and this is wide open topic. Do you mean O365 Access. If yes you can try policy where you allow the office apps and combine it with destination country (Brazil). However there is always a risk that some traffic has to leave the country and maybe some IP range from MS may not be listed correctly in the geo location DB we use. So it is a bit of a risky approach and has to be tested first.

It's a bit manual but couldn't you create a network location and create your policy based on an IP range? I think @juergen said it best that it's a risky approach depending on what Microsoft Service you are trying to use/protect with Netskope.

@rfletcher currently, there is no option to create a policy based on Destination IPs.
What @juergen suggested would be the best approach in the given scenario, with the clauses he has mentioned.