Your edit makes sense, it would be possible to block all VPN traffic but just whitelist traffic from trusted IP addresses (like those in Russia). But I don't think we have enough info to say for sure that's what's happening.