At this point, the only way to prevent Russians from using it is to ensure only dishes sold to the Ukrainian government work in that region by serial number vs any dish, and to maybe require some extra authentication, say a rolling authorization code only given to the Ukranian military?

How about default “off” over Ukraine, and then the Ukrainian government can choose which accounts they want activated?