Restrict management access to a certain country

You can do this by defining a geography firewall label then create a local-in-policy that allows access on port 443.

config firewall address
edit "Canada"
set associated-interface "wan1"
set type geography
set country CA
next
end
config firewall local-in-policy
edit 0
set intf "wan1"
set srcaddr "Canada"
set dstaddr "all"
set action accept
set service "443"
set schedule "always"
next
end

Personally, I feel this approach is not best practice -- you'll better off setting up the admin access ports on the Interface and restricting admin access from trusted hosts (see attached pic).