GDPR is the law. There are legal penalties for not complying with it. If you don't want to follow the law, blocking people from accessing your illegally operating service seems reasonable to me.