Wouldn't it only prevent formal legal entities (ie US companies) from making purchases? End users could trivially purchase via non-US payment services, and I do

Wouldn't it only prevent formal legal entities (ie US companies) from making purchases? End users could trivially purchase via non-US payment services, and I don't see how the US could actually prevent "import" or use of crypto tokens in practice. To me, it seems similar to the way the GDPR claims to apply to entities which don't operate in the EU - good luck enforcing that in practice!