Try out Cloudflare Access
I'm the product manager for Cloudflare Access and I think it's pretty neat (albeit I'm a little biased🤓)
I've stood up both an example Allowed Application and Denied Application (with a customized block page). Give them a try!
This app will allow you to login with One Time Pin or a fake SAML user:
This app will block anyone and use a dynamic block page to display additional information about why you may have been blocked:
^ The block page is a little WIP, getting the CORS configs right 😅