Auto Deselect to show in User Pickers when user has no access or is on the Deny List.

They may turn red but they will not become unknown unless the user is deactivated/deleted. Record ownership and user field association is bound to that user - which is independent of any one application or realm. Therefore removing the from the app will not affect how their name displays beyond just the color so you know that user can't access anymore. 

It would use the original HTTP API, with the most applicable being API_UserRoles. It returns the full list of users in their roles for that particular app. I was incorrect though, I thought it captured their status but doesn't. You could set this to target users with a role of 'none' and remove them using API_RemoveUser. 

All of the above could be done with Pipelines using the Quickbase / Request Channel where you invoke a QB specific API call, the rationale is that they will convert their own XML into JSON format to use. If you have access to it - you could also consider syncing the QB realm information and for any denied user in the user sync table just remove their access the same way with a pipeline search and remove user api call.