Qrew LegendWith some kind of API - no, I've never seen that setting outside of the interface. Can you just removed the denied users from the app? You could have a Pipeline that queries all the users in the app and if they're denied simply remove them from the app entirely.
If you remove them from the App, what happens to any associated records? Will we get the infamous red text "unknown" ?
They may turn red but they will not become unknown unless the user is deactivated/deleted. Record ownership and user field association is bound to that user - which is independent of any one application or realm. Therefore removing the from the app will not affect how their name displays beyond just the color so you know that user can't access anymore.
