It depends on how the government try to enact this executive order.
(Further interesting article on IEEPA and the EO here from a Harvard Lecturer)
Article Two of the United States Constitution gives the president
broad executive and enforcement authority to use their discretion to
determine how to enforce the law or to otherwise manage the resources
and staff of the executive branch. The ability to make such orders is
also based on express or implied Acts of Congress that delegate to the
President some degree of discretionary power (delegated legislation). (here)
Executive orders (EO's) may be enforced by all levels of state government. For example, state attorneys general offices can act through their own authority, seek assistance from state law enforcement, utilize the courts and judicial system, and work with state agencies that have particular policy concerns or interests. Also, county governments can enforce these orders by acting through their officials and agencies, such as county health departments and county sheriffs. See here.
Specific issues in law, are often tested as and when they present themselves. With specific reference to the EO related to 'TikTok' (here).
Section one has stated:
The following actions shall be prohibited beginning 45 days after the
date of this order, to the extent permitted under applicable law: any
transaction by any person, or with respect to any property, subject to
the jurisdiction of the United States, with ByteDance Ltd. (a.k.a.
Zìjié Tiàodòng), Beijing, China, or its subsidiaries, in which any
such company has any interest, as identified by the Secretary of
Commerce (Secretary) under section 1(c) of this order.
So - pending section 1(c) - which would see the Secretary of Commence identify which 'transactions' that were considered relevant to this EO.
45 days after the date of this order, the Secretary shall identify the transactions subject to subsection (a) of this section.
Then specifically, it authorises the S. for Commence to take actions to implement the EO, we can see Sec. 4:
The Secretary is hereby authorized to take such actions, including
adopting rules and regulations, and to employ all powers granted to me
by IEEPA as may be necessary to implement this order. The Secretary
may, consistent with applicable law, redelegate any of these functions
within the Department of Commerce. All departments and agencies of
the United States shall take all appropriate measures within their
authority to implement this order.
So ultimately, with reference to your points:
Would app stores be required to remove the apps from the app store for users in the US?
Potentially, if this was mandated by the relevant secretary after the 45 days.
Would app stores run by US companies (e.g. Apple iOS app store, Google Play for Android) be required to remove the apps from the app store for users outside the US?
Users outside the US are not subject to the laws of the US - so they could, theoretically still download the app if it is hosted on servers external to the US. It would probably not be allowed if the app was downloaded on a solely US server. This will again depend on how the Executive Order is legislated for by the secretary/agents of the US government. ("the Secretary shall identify the transactions subject to subsection (a) of this section")
Would it be illegal for a user in the US to download the app somehow from outside the app store?
Yes due to: "Sec. 2. (a) Any transaction by a United States person or within the United States that evades or avoids, has the purpose of evading or avoiding, causes a violation of, or attempts to violate the prohibition set forth in this order is prohibited."
Would it be illegal for a user in the US to use the app if they have already downloaded it?
Again, depends on how the secretary enacts this executive order. But, most likely.
Would it be illegal (under US law) for a US citizen outside the US to download and/or use the app?
This is difficult to legislate for - as once outside of US jurisdiction, you are subject to the laws of the land in which you are present. It may well be made illegal via US law, but unenforceable, for example, if the US citizen was in the UK. Ultimately, it is considered that US law applies domestically: see here.
Would ISPs in the US be required to try to block network traffic of the app?
This depends on how the secretary implements the executive order. They could pass a requirement that this happens, pursuant to the executive order. "All departments and agencies of the United States shall take all appropriate measures within their authority to implement this order."
As with everything legal, this is nuanced and develops over time. The enforcement and enacting of an executive order depends on the actions of many government departments.