Support

Let Admin Tools do its job and turn off all the emails about blocked requests.

Seriously, Admin Tools is there to block requests which are suspicious. When there are a lot of requests coming from the same IP, which means they are likely trying to attack you, it blocks that IP address for a while. If that keeps happening, they get the IP address permanently banned. That's what Admin Tools does. Let it do what it's meant to do. Don't try to interfere.

To remove the temptation of interfering, turn off emails about blocked requests. You can always see the history of blocked requests in Admin Tools, Web Application Firewall, Blocked Requests Log.

Tell your client that the entire reason of having a security solution is that you cannot control who, when, and how hard will try to attack you. Its job is to block these attacks, and it already does. He seems to be under the impression that having a security solution will result in no attacks taking place. That's an unrealistic expectation. 

You may also want to disable the graphs which appear by default on the right hand side of Admin Tools' main page. This setting is in the component's Options page. Remember what I have documented about these graphs:

The graphs on the right hand side display the number of blocked requests logged (potential attacks Admin Tools Professional has protected you against), their distributions by type and a few statistics about them, e.g. how many requests were blocked in the last year, month, week, day and so on. Please note that the number of requests blocked IS NOT MEANT TO BE USED AS A MEASURE OF HOW WELL ADMIN TOOLS PROTECTS YOUR SITE. The number of requests blocked depends on EXTERNAL FACTORS, namely how many attacks were launched against your site in a period of time. Most sites will experience a great variance of this metric over time. It is perfectly normal and very common to see just a handful or no attacks for days or months at a time, then a short but sudden burst of hundreds to thousands of blocked requests over the span of a few hours to a few days. The idea behind the graphs is to make you aware of these spikes which indicate that a malicious showed an interest on attacking your site. The graph showing the types of attacks is a good indication of what they tried to use when probing or attacking your site. That's all there is to it. These are not Key Performance Indicators (KPIs), they are just a quick glance at the information you could extract by poring over the blocked requests log yourself.

https://www.akeeba.com/documentation/admin-tools-joomla/using-the-component.html#control-panel