Cannot match Condition statement with actions and resources in s3 bucket policy

My goal is to deny write access to most of a bucket to all users except one, who has full access the the bucket defined in a separate policy attached to the user. The top-level directories of the bucket all contain similar subdirectories. I need to deny access to all subdirectory types except those named subf. Most of the top-level directories contain subdirectories named subf.

This is the policy I currently have:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::111122223333:root",
                    "arn:aws:iam::111122223333:user/system"
                ]
            },
            "Action": [
                "s3:AbortMultipartUpload",
                "s3:DeleteBucket",
                "s3:DeleteBucketWebsite",
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:PutAccelerateConfiguration",
                "s3:PutBucketAcl",
                "s3:PutBucketCORS",
                "s3:PutBucketLogging",
                "s3:PutBucketNotification",
                "s3:PutBucketRequestPayment",
                "s3:PutBucketTagging",
                "s3:PutBucketVersioning",
                "s3:PutBucketWebsite",
                "s3:PutLifecycleConfiguration",
                "s3:PutReplicationConfiguration",
                "s3:PutObject",
                "s3:PutObjectAcl",
                "s3:PutObjectVersionTagging",
                "s3:Replicate*",
                "s3:RestoreObject"
            ],
            "Resource": [
                "arn:aws:s3:::bucket-test-a/*",
                "arn:aws:s3:::bucket-test-a"
            ],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": ["*/subf/*"] 
                },
                "StringEquals": {
                    "s3:delimiter": ["/"]
                }
            }
        }
    ]
}

When trying to put this policy on a bucket, I receive the error:

"An error occurred (MalformedPolicy) when calling the PutBucketPolicy operation: Conditions do not apply to combination of actions and resources in statement"

The best clue that I have found is that the 'string condition is meant to apply as a requirement for new objects' https://serverfault.com/questions/569046/anonymous-access-to-s3-bucket-only-from-my-ec2-instances I have been having difficulty finding the documentation to dig deeper into this.