G'day Ed,
Thank you for the feedback.
From my testing I found that if a zone has "target: ACCEPT" then all traffic passes through firewalld even if you have a rich-rule to explicitly drop/reject a host/network/service. You might as well disable firewalld.
To me it seems that firewalld is only a host based firewall and not a perimeter firewall to block/allow access to your network... unless your NATing.