added a comment - - edited
Shouldn't need to do either, since the list is dynamically generated you can simply add the lines either in a role/env or default attributes file.
Just be careful to put it in ruby case, and let it get converted over, so _default[:openssh][:server][:deny_users]' = 'a,list,of,users'_.
I don't want to add more to the attributes file, the only reason it is so bloated now is that is what gets shipped with openssh by default, and I wanted to make it a bit easier for other people to know they could add the defaults back in to their environments as needed.
I use PermitTunnels like that, and it isn't listed anywhere in the documentation.