He has the same lever Congress has to force state compliance where they have no direct authority - making federal funds contingent on compliance. None of this is legal of course, but he'll slap the "National Security" sticker on it and the courts will say it's OK.
Of course this doesn't mean anyone should comply or treat this as law, and lots of his other orders are indeed meaningless garbage. But there is a clear path for stuff like this to actually become "legal and enforceable" and states should be prepared for that possibility.