F5 XC WAF Automation for Bulk IP Prefix Blocking

You can use service policy with prefix sets or prefix lists.

Each prefix set can have up 1024 ip addresses but you can attach many prefix sets in service policy rule.

How to create IP Prefix Sets with API Calls (cURL and Postman)

Still you need your automation to also remove old entries after time as to not consume everything over time and using IP reputation/IP intelligence that is free in XC may provide better detection for bad IP addresses to be honest.

Configure IP Reputation Service | F5 Distributed Cloud Technical Knowledge

Also XC Malicious User detection can add extra blocking for bad ip addresses for some preconfigured time.

Enable Malicious User Detection and Mitigation | F5 Distributed Cloud Technical Knowledge