You are absolutely correct. However, it even extends to the States. Since the Bill of Rights supersedes even state law. The states and their agencies must also protect freedom of speech.
Which means as taxpayer-funded governmental agencies, public universities, like UC Berkeley or Univ. of Wisconson, their administrators, and their faculty, must also protect freedom of speech on their campuses.
See where I am going with this?
Now private universities are different. As a private entity, they are not bound by the Bill of Rights. However, the federal government, as a condition of providing research funding to a private entity, can put requirements on that funding. Such as they do with other vendors.