Pihole only does domain blocking. Let’s say spookydomain[.]cn resolves to 1.2.3.4. You could block spookydomain[.]cn through pihole but nothing would stop a computer from directly interacting via IP address or from the Chinese to buy spookydomain[.]org and evade the block. To do a true country block, you’d need to do it at the firewall and have up to date geoip data.