OK I have a working solution at least for centos uefi. I don’t know if it will break others… YMMV
scanfor internal,external,optical,manual
dont_scan_files shim.efi,MokManager.efi,shimx64-centos.efi,shimx64.efi,mmx64.efi
I didn’t need to change anything else from default. I didn’t see any other settings I fiddled with over time either.