I know you are asking about htaccess and rewrite rules, but, you are trying to hide your hacked condition from google, rather than finding the backdoor that’s been installed, and the hacker is just going to change his method of putting spam pages on your site, you will get the “may have been” warning again, and it will be harder to get cleared by google.
And when the hacker has been alerted that you are taking action, he hides more files in your home directory somewhere, files that look innocent, but when a certain amount of time has passed they activate and there you are again.
If google says you are hacked, and you have the spam urls, you have to clean. find the infection, and harden the site.
You should have hardened the site already. Put an authentication on the wp-admin directory, run scanners delete the wp-includes and wp-admin, download the wp-content to your desktop, or in some other way store and protect it, and your wp-config and htaccess, then delete everything, wipe it all out, and reinstall clean.
Then go over the wp-content with aggression, because it’s a very likely place for hidden files. If in doubt, any doubt at all, delete it and recreate or reinstall it.
And block PHP from running in the wp-content directory.
Etc etc.
Your htaccess approach wont work.