Sharepoint Online - 4000 site permissions adjustment query

Hi everyone, im hoping for some recommendations/advice.  We have around 4000 sharepoint sites for Devices that currently have a single document library named Projects and some sub-folders in there created using pnp site provisioning.  Every site is identical.

The permissions are currently dynamic where by the Members group has a security group added that ensures all active licensed users can access.

We have a requirement to start provisioning new sites where by two of the folders within the Projects library will have custom permissions which means breaking the inheritance and then adding another security group in however from what i have read this is against best practices.

Also it doesn't help us as this will then need doing on the 4000 existing sites and having that many sites to manage at a unique level seems very scary.

What can be done here to block access to a couple of folders at tenant level for so many sites without needing to break inheritance of permissions.

Or is there no way, would one alternative be to create a new master site where every "Device" was a document library in this site (Around 4000) then the two folders in there and have a security group then assigned to the root members of that site fixing the permission requirement.

Thankyou,