According to [1], .ong/.ngo domains are eventually audited for NGO status, rather than requiring proof during the purchase. So one can technically buy it but the registrar should eventually take it away from them.
However the requirements don't state that you have to be a registered NGO in any country. Being registered as some NGO-like tax-exempt entity anywhere but China will make the audit a lot easier, but technically you should be able to pass even if you are just two people with some bylaws written on a piece of paper.
[1]: https://thenew.org/org-people/about-pir/policies/ngo-and-ong...