As a business owner, you have the right and power to require masks even without a government mandate. In the same way that you can require shirts and shoes.
This includes the right to: i) refuse service to anyone; ii) prevent someone from coming in without a mask; and iii) remove someone who is not wearing a mask or takes their mask off inside.
The key is going to be clearly and conspicuously posting the requirements outside and inside the premises, and possibly on social media.
A person who violates the clearly-posted requirements may be a trespasser in certain instances.
Depending on risk, some businesses may hire private security guards. Others should not be afraid to call the police if a situation escalates. We would not recommend attempting to forcefully physically confront someone, or expect any employees to do so, but you should stand firm (verbally) and video record the situation.
This issue has been highly politicized and you should fully expect misinformed people to try to challenge this right on the basis of their “constitutional rights.”
Please do not allow misinformed people to endanger you or your staff. They do not have a constitutional right to enter your private business.
With regard to legal consequences, you should not be too concerned about lawsuits against your business, as those would likely be dismissed as having no basis, if they are brought at all. I suspect if this issue is tried in court, it would be a single case the goes to the supreme court. I highly doubt this will happen.
The real risk is most likely with regard to attempts to tarnish a brand’s online reviews and ratings. We’ve already seen it starting to happen.
For this, I recommend responding in the normal course of business (subject to prior professional review if the situation is unstable).
Depending on the severity of damage this causes to a particular business, I suspect that there will be some recourse available to business owners (through the courts or through the rating agencies themselves).