I would like to allow only one country access, but exclude proxies within this country.
This is what I have (shortened version for convenience)
Not answering OPs question directly, but for the people finding this question in search of clarity on what's the difference between allow,deny and deny,allow:
Read the comma as a "but".
allow but deny: whitelist with exceptions.deny but allow: blacklist with exceptions.allow only one country access, but exclude proxies within this country
OP needed a whitelist with exceptions, therefore allow,deny instead of deny,allow