They can't. I can easily use a Brazil endpoint to establish a tunnel elsewhere and browse X, formerly Twitter. I suppose they could try fining the VPN service provider. (But even then they won't be able to prove what's going on.)
Seems pretty easy to enforce to me regardless of the technical ways people circumvent it.
I know, I know. There is probably some exemption for law enforcement. Or if that was overlooked, there will be soon.
But it was still an amusing thought.
China has nailed it.