Would this system block websites at the IP level or at the DNS level?

Doing it at the DNS level would mean you could roll your own DNS or use a non-US DNS provider.

Doing it at the IP level would mean the ISP reverse-lookups IP addresses back into domain names and checking against a list of banned addresses. This one could only be bypassed through proxies.