There is a few options here...
mod_security for Apache seems like the obvious choice as it can directly integrate with IPTables and block users at the TCP/IP level (rather than user-space).
Have a look here for an explanation http://spamcleaner.org/en/misc/modsec2ipt.html
csf / iptables firewall
I would be inclined to configure a software firewall like CSF - which can add another layer of protection, by rate limiting/blocking abusive IPs.
It takes a bit of configuration, but you can do some really clever things with this. http://www.fail2ban.org/wiki/index.php/Apache
Your current way
Also, to comment on your original post, you can but multiple IPs on one line of the allow/deny directive, see http://httpd.apache.org/docs/2.2/mod/mod_authz_host.html
Finally, if you were to continue to use your method - you can block at the .htaccess level with the same syntax (minus the tags)
allow from all
deny from 184.108.40.206 220.127.116.11 18.104.22.168/24
Your current method seems un-scalable and relies on your ability to judge genuine/malicious traffic - so the automated solutions above would be highly recommended.