It's HR's entire job to set policies for hiring. They can say a candidate has to have a college degree. Why wouldn't they have the right to set this policy as well?
Protected class cannot be used as a factor in hiring. Saying "we can't proceed with an offer until we've hired at least one woman and one URM" (which is what Meta's DSA entailed) is indeed using protected class as a factor in hiring.