How can I avoid to return HTML markup for access denied?
If you look into ParagraphAccessControlHandler you will find something similar.
Implement something similar in your Access callback.
protected function checkCreateAccess(AccountInterface $account, array $context, $entity_bundle = NULL) {



// Allow paragraph entities to be created in the context of entity forms.
  if (\Drupal::requestStack()
    -&gt;getCurrentRequest()
    -&gt;getRequestFormat() === 'html') {
    return AccessResult::allowed()
      -&gt;addCacheContexts([
      'request_format',
    ]);
  }
  return AccessResult::neutral()
    -&gt;addCacheContexts([
    'request_format',
  ]);
}