Is it safe and fine to block external access to sites/all/modules folder and all its subfolders and files? That's to say block all except 127.0.0.1?
If you are talking about blocking HTTP access (for browsers), then it won't give you any additional security. 

But if you nevertheless want to do so, then exclude *.css, *.js and all images from being blocked.