Yes both can be done, we do recommend a strict blacklist over a whitelist from a useability perspective