Chances are you won't be using a VLAN "virtual local area network" to do this. Keyword being local. What I believe you want is to limit by IP address ranges, assigned only to the countries that could use your resources legitimately.
There is not a perfect solution to your need. I would be awesome if you knew the IP address of every user but chances are that you don't.
Challenges are that IP address are not as simple as phone numbers, in the way we can just block a county code. The addresses were allocated far more randomly and countries that use them can change over time. Another challenge is that your users or customers could travel and would like to reach your services from other countries that you block. People with malicious intent can come from within the countries you don't block or could spoof their IP address using a proxy and appear from another country. I'm sure I could come up with more but that is a good start.
All that being said on to solutions:
If I were looking for a quick and easy solution to block or only allow certain countries I would talk to my ISP and see if they already have a quick affordable solution.
You can use deny or allow rules based on the IP addresses found in lists. Here is an article that discusses this solution http://blogs.cisco.com/security/block-a-country-with-my-cisco-router-or-firewall/
Cisco has their solution that they want to sell you traffic-anomaly-detector-xt-5600a and they tell you in a whitepaper article why firewall equipment is not the best solution for DDOS.
You could create alarms around DDOS and then view the logs at that time and then block the problems as they happen.
I don't know anything about the code you are using but some limit within the application but there are Apache and other solutions.
This is one of your better options for using an ASA to mitigate DDOS