I genuinely think that there is no legitimate use case for disabled copy paste. It's just nonsense security theatre (which banks absolutely love)
Just track the paste operation and place a big red CHEATER banner on the username.
Also what can be disabled with javascript - can be enabled with javascript.