An Access Control List (ACL) is indeed capable of blocking traffic based on IP ranges; in this case, it can be designed to block traffic originating from a specific internal subnet, thus preventing it from accessing services in a public cloud. Using ACLs in such a manner is a common practice to ensure that only authorized network traffic is allowed to communicate with certain parts of the cloud infrastructure.