Preventing unwanted access
I agree with the comment above about IP-based restriction perhaps not being the best approach here, or at least not using it as the only means to detect duplicates.

I think GeoIP is reasonable for blocking at a country level (though certainly not foolproof).

I think IP address might be a reasonable component to duplicate detection.  You could also add other duplicate detection mechanisms including:


User ID (which is something you seem to have but are not using - I would think this would be most authoritative piece of information if there is authentication/login attached to this user ID)
setting a cookie
inspecting user agent
setting value in browser localStorage and then have browser add to request (localStorage is a little harder for a typical user to clear out than cookies)


With regards to the code itself, you should get in the practice of inverting conditions when you have large blocks of code nested in a conditional (or really just in general to provide clear, early exit paths from a section of code).

For example:

if(!in_array($countryCode, $allowedCountries)) {
    // set location header and exit
}
if (checkForBlockedIP($projectID, $ip)) {
    // set location header and exit
}
if (checkForDuplicateResponse($projectID, $ip)) {
    // set location header and exit
}
// happy path code follows


There is no reason for your else blocks at all here from what I can tell.  As a general rule of thumb, the less nested code and code branches you have, the less prone your code is to bugs, so you should actively look to design away such constructs where possible.