G Suite Marketplace Add-on OAuth: Error 400: invalid_request Account restricted

Has any Google Add-on developers received this error when a user trys to install:

Error 400: invalid_request Account Restricted

This only happens to some users even if the app is whitelisted in the domain admin console of the user. Our app is listed on the G Suite Marketplace and is approved and verified, the OAuth consent screen works for most users. The user is able to see the consent screen but as soon as they click Accept they get this error:

I had the same issue with one of my G Suit accounts. In my case, there was an issue with one of the scopes that the Google Spreadsheet script has been using. To be more specific https://www.googleapis.com/auth/classroom.topics.readonly. This scope is required if you want to work with topics in Google Classroom. I am pretty sure there was some kind of account restriction but unfortunately, I was not able to find the respective setting in Google Admin Console. I have contacted G Suite Support as someone suggested here but they were not able to help me. Eventually, I had to remove this scope from my script and it worked fine but you may have issues with other scopes and here is how you can find out which one is causing the problem.

Steps

1. Find an account that consistently has this issue
2. Create new google spreadsheet
3. Go to the Tools -> Script Editor
4. Click View -> Show Manifest file. This will create a manifest file called appsscript.json
5. Then start adding scopes from your list of scopes one by one to the oauthScopes field in a json file. If it's not there then add it
6. Click Run -> Run function -> your function