That's what the judge agreed with: it's unreasonable to require you to block all Internet traffic with the assumption it's all VPN traffic until proven otherwise.

Under Utah's law as written, a private business has to assume any single IP address could be operating a VPN/proxy.