IANAL

Two things: “reject all” should be as easy as “accept all”. GDPR seems pretty clear about that, to me at least. Almost all (if not simply all) 3rd party implementations get this wrong. I can only assume they’ve never been challenged on this, or found a loophole. “Native” European sites (governments, official bodies, TV stations, …. ) are the only ones I’ve seen do this correctly.

If your cookies don’t have any tracking you don’t need to ask consent. You don’t need a pop-up. You don’t need any user interaction. All you need is a notification somewhere on the page.