Does the fact this is hooked into the user_setup event mean it will be re-evaluated at each page access, or is there something that keeps it from being quite that frequent? This just came to mind when </Solidjeuh> asked about database access.
Since the MaxMind database is local, it's not like "there will be a new decision if we load and query the database again." At least not until the MaxMind database is updated "on Wednesday", and/or unless the administrator makes a configuration change as to which countries are excluded. As compared to if an online version of the database was being queried, and we would have no idea if our next query will get the same answer or not.
Which made me wonder, would there be a performance benefit to tying this to "session creation" or similar, rather than "user setup". Or perhaps "keep checking during user_setup", but checking a decision which has been "cached", either in the session info or in your own private cache. Such that if the MaxMind database was already checked for the IP address in the user's session, and there hasn't been a configuration change or database update since then, the cached decision continues to be used rather than making a new decision.
Probably not describing anything you hadn't already considered or can see additional challenges for; it just came to mind on the performance question. I have no idea what kind of performance or resource impact is created by the MaxMind database loading and reader they provided, to guess at how significant or insignificant the savings would be from caching.