Do you use the TPP-Nok-Redirect-URI in case an SCA is failing?

No. OAuth2 only supports one redirect URL and we only use the TPP-Redirect-URI.