
Explanation:

Create one service domain group (Allow list) containing Site1 and Site2 and configure the policy action
"Allow upload only to sensitive service domains".
Create a second service domain group (Block list) containing Search1 and Search2 and configure the policy action to block paste (clipboard) to these domains.
A single Endpoint DLP policy can enforce multiple activities (upload to cloud service domains + clipboard to specific domains), so only one policy is required.
Refs: Microsoft Learn - Endpoint DLP: Configure service domains and policy actions (upload/clipboard restrictions) (Purview > Data loss prevention > Endpoint DLP settings and policies).