After tons of digging it appears that the way the error message is worded was a bit misleading.
Refused to load https://www.service-domain.com/ because it does not appear in the frame-ancestors directive of the Content Security Policy.
What isn’t clarified above is that it wasn’t the server/site I was working on that Refused to load from the vendor’s domain, but rather that it was the vendor’s property that Refused to load itself into the domain I was working on.
The header snippet above does work in case anyone ever needs it, but if you see that specific error message be aware that it’s the other domain, not yours’ that is restricted.
As an aside, the issue stems from the fact that the work is being done on a development/staging domain, but when the account/profile was set up with the vendor the current Live/Production domain was used – so the domain I’m calling from isn’t listed as being authenticated and is thus being blocked.
Hope this helps someone that comes across a similar issue.