Just turn on Bot Fight Mode, that should be sufficient. If you have a very high risk scenario permanently turn on the under attack mode and it will throw a Turnstil captcha at all suspicious requests. In that scenario you should probably set up a WAF rule to block all Tor requests too (it's under the "country" selector).