1 & 2 contradict. You're suggesting blocking the IP addresses of known VPNs (which is what they would have to do if they wanted this to work in the slightest). DNS blocking (which is something they've made ISPs do in the past) is pretty pointless, since you can resolve the IP address of a host multiple different ways (like switch DNS server, use a custom downloadable hosts file...)

They'd tell the ISPs they need to block traffic to VPNs, and then fine them if they let traffic through, shifting the responsibility to the ISP.