S3 Policy Deny for all principals but

I am attempting to deny public users from accessing signedUrl paths directly, unless it's loaded by my website <img> tag.

Typical users should not allow to copy the image URL directly in the address bar and download the image.

The allow policy

    {
        "Sid": "Allow public with signedUrl",
        "Effect": "Allow",
        "Principal": "*",
        "Action": [
            "s3:GetObject",
            "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::my-chat-attachments-development/*",
        "Condition": {
            "StringLike": {
                "aws:Referer": [
                    "http://localhost:4000/*",
                    "http://localhost:3000/*",
                    "https://mydomain1/*",
                    "https://mydomain2/*"
                ]
            }
        }
    },

Below explicitly deny public access. Without the following policy, public users can still copy and paste image URL directly in the address bar (undesirable).

    {
        "Sid": "Statement to deny anybody without referrer",
        "Effect": "Deny",
        "NotPrincipal": {
            "AWS": [
                "arn:aws:iam::1234:user/S3UserfullAccess",
                "arn:aws:iam::1234:role/LambdaFullAccess"
            ]
        },
        "Action": [
            "s3:GetObject",
            "s3:PutObject"
        ],
        "Resource": "arn:aws:s3:::my-chat-attachments-development/*",
        "Condition": {
            "StringNotLike": {
                "aws:Referer": [
                    "http://localhost:4000/*",
                    "http://localhost:3000/*",
                    "https://mydomain1/*",
                    "https://mydomain2/*"
                ]
            }
        }
    }

Problem

I have the above policy settings, and it works well (public users are shown a access denied page). However, it also means my lambda, and my nodejs app servers cannot access the S3 even though I added NotPrincipal in the policy.

Please advise how can I correct my policy to achieve my desire behavior.

PS: I do note the above referer hack will not stop technical users from spoofing referring addresses.