IPSEC Policy base rules

I have successfully set up an IPSEC tunnel using policy base as the other end doesn't support interface mode. I have created a simple rule: 

config firewall policy

    edit 8

        set name "IPSEC to H2"

        set uuid c5b4e622-67a8-51e8-f7ef-f1a2eec092f6

        set srcintf "v31"

        set dstintf "wan1"

        set srcaddr "all"

        set dstaddr "192.168.0.0 [DMZ_H2]" "192.168.1.0 [INTERNAL_H2]"

        set action ipsec

        set schedule "always"

        set service "ALL"

        set logtraffic all

        set inbound enable

        set vpntunnel "h2"

    next

end

 Is there a way to block certain incoming traffic from the ipsec? If I try to make a rule on the wan1 to v31 it does not seem to block. 

config firewall policy

    edit 10

        set name "Block Nas3"

        set uuid ae7c2586-6831-51e8-e4d9-5440e79dcb5d

        set srcintf "wan1"

        set dstintf "v31"

        set srcaddr "192.168.0.0 [DMZ_H2]" "192.168.1.0 [INTERNAL_H2]" "Comcast H2"

        set dstaddr "192.168.31.10 [Nas3]"

        set schedule "always"

        set service "ALL"

        set logtraffic all

    next

end

 Trying to block a nas file server from the remote site. There doesn't seem to be a way to do this with it in policy mode. I do not see a way to set a policy to say from remote site to local block. Interface mode would be easy but my other side does not support interface mode.