There’s no way to increase that limit on your own. I don’t see a limit listed in the API for the filter, so that may be worth a try.
Otherwise, you may have to break it down into two firewall rules.
You may want to “reverse” your rule. Make a bunch of If NOT a referrer you want, then JS Challenge. Then keep an eye on your Firewall Events log for challenges you want to whitelist in that rule.
I believe the referrer policy header only applies to outbound links, so the destination can or can not see that your site referred the visitor out to them.
You’re correct regarding outbound links. If it’s set, however, they will know when it’s one page or another of their site that was from where the header was sent. A subdomain setup is helpful for this, if not needed due to subs being considered different origins in modern browsers.