Little-publicized, to the point that even Support isn't in the loop: the Visibility Rule Contains operator does allow multiple values.
The Contains value is interpreted as a full-fledged regular expression, so use the pipe character | to separate sub-values:
In fact, because of this unexpected/undocumented power, you must anchor an expression to avoid surprises:
^(TX|FL|PA)$
Otherwise, it's doing a partial match of the full value against each of your pipe-delimited alternatives.
For example, if you were using uppercase state names, then Contains KANSAS|IDAHO would match both ARKANSAS and KANSAS, and you should use Contains ^(KANSAS|IDAHO)$ instead.
You can also of course do more fancy matches with regexes if you want. And Not Contains is also a regex!