A private company can unfortunately choose to enforce a vaccine mandate if they want to. IANAL but it appears most states do not have any protected class for this, so it seems to be legal for a private entity to choose to make their own private mandate as a term of employment at their own volition.

For the record I think this shouldn't be legal and I think companies should not be allowed to do this except in extremely specific circumstances, but we need to manipulate the game given the cards we're dealt, not the cards we want.