The law change basically forces sites serving a domestic audience to use a domestic domain registrar where the government has the legal authority to seize them when they wish to. There is already a whitelist system in place (ICP licensing) but site owners can always take their operations elsewhere as long as they retain control to the domain.

That said, it is vague enough that an IP whitelist can be inferred from a very liberal interpretation. The NYT writeup reiterates this point.