apparmor="DENIED" operation="mount"

yes, it’s probably best to allow systemd to do it’s thing.