This is all just my opinion, but I think it would be done through an executive order, but it would be more symbolic and advisory because you would still be facing the issue of states rights.

Or, they (either Congress or POTUS) could also use something like federal highway money to basically extort states into compliance, similar to how the feds have used it to force states to make 21 the legal drinking age.

As far as how you appeal, I would guess it depends on how it’s done. To be honest, if a business like Walmart wants to bar you from entry for not wearing a mask, that’s their right, and they shouldn’t need the backing of an executive order to do it.