I'm not sure about OpenAI's internal policies, but I've worked for several SaaS companies that complied with Export Administration Regulations (EAR) to limit access to "Embargoed and Sanctioned Countries" which has meant CRIMEA - REGION OF UKRAINE, CUBA, IRAN, NORTH KOREA, and SYRIA. ITAR (defense related) and OFAC (finance related) both have further restrictions. For us, it was easier to block all of Ukraine rather than limit to access to Crimea in particular.
Trade compliance requirements may require embargoing occupied Ukrainian territories however it isn’t necessarily possible to distinguish between occupied and unoccupied regions. Export controls might be applied based on geoIP with granularity at the country level. Unfortunately the safest position from a compliance perspective is to block the entire country than risk getting it wrong.