The government can decree that ISPs have to block the IP addresses of known VPN endpoints. That's perfectly possible. They did something similar with piracy sites before (e.g. if you go visit piratebay on virgin media you'll get an error page). It's a game of cat-and-mouse because if it's done with DNS then aliases pop up immediately, and if it's by IP then other proxies pop up, but the fact is they could make is so difficult for average users that people give up.