If a customer has decided that they want to get rid of on-premises NetScaler and replace it with Gateway Service, can they just flip straight over from one to another? Or is there a level of preparatory work needs doing?

They will want to check out and implement rendezvous but they can use both together during transition then shut off the netscalers after. Just make sure they understand service continuity vs local host cache and the availability slas for the cloud services.

How about geo-blocking certain countries and allowing specific public IPs on demand? I know we can do geo-blocking with StoreFront cloud, but not sure about allowing selective public IPs from blocked countries.

I would personally review the NetScaler configuration as they could be using custom customizations and certain authentication methods not supported by the gateway service and features like content switching / load balancing/re write /responder and other features on the NetScaler. If its just used for ICA proxy with basic config and simple auth requirements then yeah its pretty simple to move to gateway service (You will definitely want to use rendezvous)