[Magisk] WhoIsJohnGalt1979:
The secret lies in the setup. Don't intend to sound like an expert, but this has been my due diligence since day 0 with Pixel 6 pro and now with Pixel 7 pro. Please do not forget to thank the kind people like @roirraW "edor" ehT @Homeboy76 @V0latyle whose posts I have been following for a couple of years now. Let's assume your use case and walk backwards before we move forward.

1. Disable and Remove all modules from magisk including USNF and Shamiko ( in case you already have and it's not working). Yes its a pain but I assure you its a one time thing. Disable Zygisk too. Reboot phone. So now essentially you have a rooted phone with stock/third party kernel and Zygisk No and No modules (your modules page would be blank). Follow this with uninstalling all the apps that you want to include in the Deny list and have them already installed (yes its a pain too). Please uninstall them correctly, Delete data, cache, force close and uninstall. Follow this with deleting data and cache from playstore and gms. Once all done, reboot your phone again. This will bring your phone to a state where you will get three red crosses in Play Integrity API checker app - Ground 0 state. This state is also similar to when you have made a clean flash to stock and just rooted your phone (in case you intended to do that, start from here). Now just install Wallet and Company Portal (for example). Do not install your other apps that you had uninstalled (banking etc) yet.

2. Now flash the latest Displax USNF and Shamiko one after another in Magisk, dont reboot phone.

3. If you have not hidden magisk yet, hide it from Magisk settings section..

4. Enable Zygisk - dont reboot phone even if you get prompted.

5. Do not check Enforce Deny List. Now enter Deny list and just check Wallet. Ensure that all subcomponents of wallet are also checked (its finicky, so manually do it if needed)

6. Now put your phone in Airplane Mode.

7. Delete data and cache for Wallet, Play Store and Play Service (GMS) from Apps. Once done immediately restart the phone. Disable Airplane Mode. Check Play Integrity API checker app and Wallet and the Devices tab in Google Security Section - All will be working as intended.

8. Now for the other applications, install in groups of 3, same, add them to deny list after installing, put the phone in airplane mode, delete data, cache and force close app and immediately reboot phone and disable airplane mode. Why 3, for some odd reason, while deleting data and cache for some for example 12 apps, one or two fall through the crack, dont ask me why, just saying. No interaction with playstore of gms is needed while doing this.

If you are an experienced user which you clearly are from your post count, you would probably be laughing your guts off reading my childish instructions. Good luck!

In the future if lets, say your Citi bank app gets updated and shows root, and when you go to deny list you see an additional subcomponent added to the Citi app, exit Magisk, delete cache, data, force close and uninstall app, "reboot phone", install citi app, add it to deny list (make sure all subcomponents are selected now), put the phone in airplane mode, delete cache data force close citi app, reboot phone, disable air plane phone and you are good to go.