There isn't remotely any possible way to enforce this. There are thousands of registrars out there and there's no way to know all the domains owned by a single person or company. Even if you solve that problem, now you'd just have domain squatters spinning up shell LLCs.

Also you have no way to properly define "legitimate".