There are two kinds of bots - one that the very act of them futzing with your site is degrading performance (think AI bot DDoS), and the other that is annoying but not harming you directly.

The second is best "blocked" by doing nothing at all and instead silently dropping them from analytics.