What would be considered due diligence (or whatever the proper term is) in preventing users in export-control blacklisted countries from accessing a web application that features strong encryption software (symmetric keys longer than 56 bits)? Would checking the client's WAN IP against country's IP address range lists be enough?
Check the IP is the first step that helps you filtering requests, however even if they pass the IP check I would also ask to select the country they are from.
Allowing access only to those country allowed or provide an alternative output (if possible) based on weak encryption to those in other countries.
Add to your terms and conditions that you don't allow access to your site from certain countries. Now everyone doing so is violating your terms and conditions. That should stop them right in their tracks.
Just like certain websites have a button that says "I'm over 18" and don't give you access until you press the button.