Geological (Country) lock policy for all services and Cloud Identity premium to access Context aware access

[Anson Mariyanayagam]

I am more familiar with Microsoft side where you can apply a conditional access policy to block login from all the countries for a member of certain group outside the named locations (approved locations like CA or US).

With my research, I think I am able to do this via Context Aware Access which would need Cloud Identity Premium license.

My questions are how can I achieve my goal via Context Aware Access?
And Does all the users need the Cloud Identity Premium license for this to work or just for the admin is enough?