I'm looking to remove access to select sites in our Sharepoint intranet for a group of users in a division we're divesting. I have a "M365" type dynamic group which should include all those employees. I don't see a "deny access" permission level I can use so am wondering if there's another way without resorting to conditional access policies (which don't seem to work).
You wouldn't "deny" access as such, you simply wouldn't grant those users permissions to the site. If you've granted permissions to the site via a group that contains those users, then you'll either need to remove the users from that group or use a different group to grant access that doesn't contain those users.