The NCAA is a voluntary membership organization. No college or university is forced to join it. No matter what a state law says, the member institutions agree to the NCAA rules to be a part of the NCAA. They also agree to abide by NCAA punishments if they are found to have violated the rules. On top of that, it's a self policing organization, which means that member institutions are (a) expected to follow the rules, (b) self report if they discover a violation, (c) self investigate the violation and report the findings to the NCAA and (d) self remedy the violation, meaning applying appropriate punishment, and making necessary institutional changes to ensure they won't commit the violation again. After the institution has completed that process and reported their findings, changes and punishments to the NCAA, the NCAA then conducts their own investigation to determine if the institution's findings and actions are appropriate. If they feel they aren't, then and only then does the NCAA levy action against the school.
The NCAA isn't some governmental agency. It's just a collaborative of college and university presidents and chancellors who set and oversee the rules that everyone agrees to play by. Either you're a member and follow the rules, you wield enough influence to change the rules, or you leave the NCAA and form your own organization. The state has no say in it so long as the schools are members of the NCAA.