If you are using Geo Policy located under Shared Polices, and not R80.20+ Geo Updatable Objects this is expected behavior. The Geo Policy check is performed right after anti-spoofing enforcement and prior to any Access Control policy layers.
Prior to version R80, the geo enforcement mechanism was called Geo Protection and was simply another protection/signature of the Threat Prevention IPS blade. However in R80 Geo Protection was moved out of the IPS blade into the Access Control policy and renamed Geo Policy. However in some logs you'll still see references to the IPS blade (and sometimes the old term Geo Protection) even though Geo Policy has nothing to do with the IPS blade in R80+. So it can look a little confusing as generally Access Control is always enforced prior to any Threat Prevention inspection.
Note that there are also some other Threat Prevention reputation checks that can potentially drop traffic prior to any Access Control policy checking/enforcement, see here:
Are IoC feeds processed before Access Control policy
Geo Policy was deprecated in R81 (although it is still supported) and you should use Geo Updatable Objects instead going forward.
Gaia 4.18 (R82) Immersion Tips, Tricks, & Best Practices
Self-Guided Video Series Coming Soon