While this sounds like an overreaction, I question the breadth of this method (unrelated to the reliability of IP address origin).

> This tells nginx to assign the $allow_visit variable a 0 for any users the GeoIP database specifies as coming from the “EU” continent.

Europe is the continent. The EU does not encompass all European countries. Doesn't this needlessly block non-EU European countries?