How would they enforce this on open source projects without companies behind them?

This doesn’t require the user to be able to block, it’s required that there is the ability to block a user from the system in general.

Here is the official list of nextcloud providers that do the setup and maintenance for you: https://github.com/nextcloud/providers#providers