I'm guessing Congress justifies its authority here based on national security. The bill refers to "foreign adversary controlled applications".
This is also overwhelmingly likely to go unchallenged by the court system due to the provision being passed with overwhelming bipartisan support.
Internet service by one company is not trivial to address in a "ban". Unlike, for example, a chemical molecule. At least they have the experience in specifying and addressing that.
I think we might be able to manage to identify a company with hundreds of millions of users trying to mask themselves by... changing their name.
It's not like we're going to firewall them off. The bill bans distribution of the app in the US app stores and US companies from offering any kind of internet hosting services related to the app.
The same way that the government addresses most issues. They tell people not to do something, and if they refuse then they get fined, their assets frozen and confiscated, and eventually people are arrested.
Bytedance would have to withdraw all its assets and employees from anywhere in the west to escape the consequences.
They have to store the data somewhere and it much more likely that they will sell than engage in value killing whack-a-mole with federal agencies
"The Congress shall have power to lay and collect taxes, duties, imposts and excises, to pay the debts and provide for the common defense and general welfare of the United States; but all duties, imposts and excises shall be uniform throughout the United States; To borrow money on the credit of the United States; To regulate commerce with foreign nations, and among the several states, and with the Indian tribes; "
But the bigger question is the literal one you've asked: how the federal government can just ban TikTok?
What makes the government think that they can stop packets at some arbitrary line in the sand, when every indication in the history of the internet shows the opposite?
They were unable to stop drug cartels. And drug cartels need a highly centralized and sophisticated organization, and need to ship a physical product across a border.
Whether right or wrong, whether politically motivated or not, it has gone through the house, senate and president which is not a small thing.
While this bill does refer to a specific organization, it doesn't punish them for past actions, but rather constrains US companies in the future. That is perfectly ok as shown in cases like Huawei v. United States or Kaspersky Lab, Inc. v. DHS. Like Kaspersky, it's "prophylactic, not punitive."
This is a totally bunk argument. If you want an argument that does work against the constitution, SCOTUS' "empty shell" or Lysander Spooner's "Constitution of no authority" are of far more weight, but have more disturbing implications (e.g. You can disregard it completely; our system is precisely the "odious arbitrariness" the founders denounced).