How to deny access to an entire class A block of ip addresses?

I operate our Microsoft SMTP server. I want to deny access to an entire class A block of ip addresses.

Example. I want to deny all incoming ip address for the entire class A block beginning with 5. (such as 5.6.17.200) but I want every single IP address blocked in the entire class A. I'm aware of the ramifications and will do this in my SMTP server? How should it be written, including subnet?

Like this:
IP Block 5.0.0.0. Subnet 255.255.255.255
or
IP Block 5.0.0.0. Subnet 255.0.0.0

Or some other variant? As you can see, I'm not sure if the "0" allows or denies.