This options specifies a list of IP address ranges that are denied to connect to the Samba server.
hosts allow and hosts deny lines are interpreted to give hosts allow priority over hosts deny. This means that you can deny all IP addresses, then allow specific addresses.