I think currently the easiest solution is using Discourse Dynamic Groups to create a group of “chat allowed users” based on the trust level 1 group while excluding those you added to a “not allowed to chat” group.
So the setting for who is allowed to chat (or use DMs) is no longer TL1 but the dynamic group of TL1 without bad actors.