If I recall by browsing the docs, there's a lot of fine grained client control over the blocking params. Which makes sense since the main product of cf is bot blocking.

So you can definitely block by IP, by fingerprint, both or neither