Is it possible to restrict granting access to terminated users but still allow access to be removed from terminated users manually?

For option 1 you won’t need a new QuickLink, only a new Quicklink population.

As an admin, go to the gear icon, Global Settings and select Quicklink Populations.
Select New and enter a Name/Description. Set the membership to what you want it to be.


Next, set ‘Who can Members request for’. By selecting everyone and not putting a filter here, members of this QL population will be able to see all users (Even termed).
Finally, make sure to set what they can remove. This will allow members to remove entitlements/roles from terminated users based on your description.

You can tweak these settings to get your desired result.