Ban SiteNames Multisite

You can filter domain_exists, a check that runs before a site is registered. If you return a positive integer, WordPress will not create that site. Despite its name, that filter lets you check the path too.

Sample code, not tested:

add_filter( 'domain_exists', function( $result, $domain, $path ) {

    // Already taken, no need for further checks.
    if ( $result ) {
        return $result;
    }

    $blacklist = [
        'domains' => [
            'assets.example.com',
            'wordpress.example.com',
        ],
        'paths' => [
            'wp-admin',
            'wp-includes',
            'wp-content',
        ],
    ];

    if ( in_array( $domain, $blacklist['domains'] ) ) {
        return 1;
    }

    $path = trim( $path, "https://wordpress.stackexchange.com/" );

    if ( empty ( $path) ) {
        return $result;
    }

    if ( in_array( $path, $blacklist['paths'] ) ) {
        return 1;
    }

    return $result;
}, 10, 3 );