Would this system block websites at the IP level or at the DNS level?

Doing it at the DNS level would mean you could roll your own DNS or use a non-US DNS provider.

Doing it at the IP level would mean banned IPs and reverse-lookups of IPs back into domain names, checking against a list of banned domains. This one could only be bypassed through proxies.