How is this implemented? It must SpaceX/starlink that does the actual access/no access whitelist mechanism based on what they getting from the Ukrainian authorities?

Whitelists are updated daily. There are separate verification processes for private individuals, businesses, and military entities. Detailed instructions are available here: https://thedigital-gov-ua.translate.goog/news/technologies/w...