You could modify the example here - https://ipdata.co/blog/how-to-block-website-visitors-from-a-... to work with states easily enough.