They may or may not be able to require ISPs to block specific sites. Piracy isn’t protected speech. It’s going to be a moot point because it’s not something that can get actually passed.

They cannot require ISPs to block VPNs. General tools for/access to the internet are protected speech. They could require VPNs that have physical servers in the US to block exits to specific sites (if the first part is valid), but that doesn’t do anything when it’s trivial to have exit nodes elsewhere and structure your service/corporate structure so the exit nodes are not subject to US jurisdiction.