I want to extend this to webmail login only. Our clients are 100% inside the United States. It would be great (at the domain level) to allow blocks like this. If a domain choose to allow awesome. Most those will want to block logins from outside the United States.

One way you might be able to achieve this is via CloudFlare. Cloudflare DNS allows you to route HTTP/HTTPS requests through their servers, at which point you can apply firewall/application specific rules to the traffic. In this case you'd just need a page rule that drops traffic to your webmail interface originating outside of the USA. You can also add foreign IP address ranges under Settings>Security>Blacklist to ensure the same locations cannot access the IMAP, SMTP, POP ports, etc.