The key here is using Location (instead of Directory) for your Deny directive (otherwise your JkUnmount’d calls will not be blocked)

  SetEnvIfNoCase User-Agent "Firefox" bad_bot

  <Location "/">
    Deny from env=bad_bot
  </Location>