How does the government... ban something... in a budget bill?
Both parties say "we'll pass this spending bill if you let x, y, and z completely unrelated bills be attached to it." Then both sides can say "we got this bill you wanted passed" and "I didn't want to vote for X but I had to support the budget bill."
It's a ridiculous system.
I've not looked into the specifics here but it wouldn't be out of place to tie aspects of budget funding to the existence of a questionable security risk being present in a government assisted environment.
Each agency, bureau, department, school, and institution would not just have to have IT people to implement the whitelists (eg- in mdm or by policy, which they may not already use), but get people to serve on committees to approve, build, and maintain the whitelists, create the processes to field and test all whitelisting requests, create a process exception request process, and coordinate with whatever external governing or regulatory bodies' lists to ensure compliance.
It wouldn't take long before the employees would just start using their personal devices and hotspots for everything to avoid the hassle, which would be so much worse.