Enforcement against non-EU entities is difficult, and especially digital services would be impossible to shut down. Ultimately, enforcement would depend on judicial assistance between the relevant EU member state and the jurisdictions where the data controller is established or has relevant assets.
Your case involves physical goods and other regulations though, so that (some amount of) compliance by the data controller is necessary in order to have continued access to the EU single market. Which instruments for enforcement of fines are available depends on the EU member state, but could e.g. involve confiscation of products or payments.
A non-EU B2B service provider would also have economic incentives to comply as EU data controllers cannot share personal data unless an adequate level of protection is ensured.
In reality, it is fairly unlikely that non-EU data controllers will get fined anytime soon because data protection authorities tend to prioritize more clear cut cases, and tend to stay within their jurisdiction. Of course, non-EU data controllers are usually required to register an EU representative precisely to subject them to a particular authorities' jurisdiction, but a non-compliant controller is unlikely to do that.
A note on the GDPR's territorial scope: it is far less extraterritorial than some people believe. Per GDPR Art 3(2) the regulation applies to non-EU data controllers, (a) to the extent of their processing activities that relate to offering of goods and services (also unpaid services) to data subjects in the EU, or (b) when they monitor/track behaviour of data subjects as far as the behaviour takes place in the EU. For example, a B2C company would have to comply with the GDPR regarding how they handle shipping addresses of their EU customers. The EDPB has issued in-depth analysis as part of their guidelines 3/2018 on the territorial scope. However, the ECJ has found that some of the GDPR's effects are confined to the EU. For example, Google has to hide some results from EU searches in order to comply with the GDPR's Right to Erasure, but cannot currently be forced to hide the results from non-EU searches.