Few multi-tenant SaaS offerings support IP range blocks at the service level because they have shared frontend infrastructure. Those that do tend to implement the restrictions at a user level as part of identity management. See for example Salesforce's Restrict Login IP Addresses in Profiles.

Accordingly, the reasonable way to address that is through a "Conditional Access" authentication policy from an integrated identity provider. Okta, Azure AD / Entra ID, etc. have various IP/network origin based policy options that will block logins that originate from outside the specified network, approved devices, etc.

See for example:

• Okta: How to Allow Access to the Okta Applications Only from a Specific IP Range
• Okta: Configure an Okta sign-on policy
• Azure AD / Entra ID: Using the location condition in a Conditional Access policy
• Ping: Web authentication policy configuration - Configuring an accessing from company network rule (web policy)
• OneLogin: App Policies - IP Address Allow List
• SailPoint: Restricting IdentityNow Access - Specifying Network IP Restrictions