Zscaler and Minecraft: a battle of wills

I’ve finally come across a real challenge: Getting Minecraft to work together with Zscaler. In a nutshell: I’ve tried everything. SSL bypasses, tunnel bypasses, authentication exemptions. Nothing will work. Minecraft launcher takes forever to fully load, sometimes it can’t even get information about your accounts; sometimes it can. If it loads after 2-3 minutes, you can’t play online.
Now here’s a really strange thing: even if I disable Internet services (ZIA), it still won’t load, which is really strange.
(5 hours of troubleshooting later):

What loads even if ZIA services are off? WFP driver of course. Once i disabled the driver in app profile, it all worked fine.

Here’s my complete policy set for Minecraft:

1) a firewall policy which allow all ports to certain IP addresses and I’m quite sure i don’t have the full set yet.
142.251.153.119, 192.178.223.84, 52.123.242.82, 23.214.208.9, 142.251.155.119, 142.250.117.113, 142.251.157.119, 216.239.36.223, 142.251.150.119, 142.251.30.139, 216.239.32.223, 142.251.156.119, 142.251.152.119, 2.19.252.154, 92.123.128.170, 92.123.128.181, 92.123.128.134, 2.19.252.151, 92.123.128.174, 216.239.34.223, 142.251.127.84, 142.251.151.119, 172.217.76.84, 8.8.4.4, 8.8.8.8, 142.251.154.119

2) Another firewall policy to allow certain ports needed by multiplayer (17404, 46500, 25565, 25561) but only at weekends (for all users) and in the afternoon for my son.

I block everything else (apart from DNS, HTTP and HTTPS) in another policy further down.

3) Then I have an SSL inspection policy which exempts a lot of URLs from being inspected (www.bing.com,minecraftservices.com,.overwolf.com,windows.net, .minecraft-services.net, .mojang.com, bing.com, .minecraft.net, .minecraftservices.net, dns.google, googleapis.com, .minecraftservices.com, .live.com, .xboxlive.com,.xboxservices.com, gamepass.com,microsoft.com)

I inspect everything else in a further policy.

I will also use Microsoft Family settings to only allow 2h of active time every day.