How can I explicitly Deny lambda:InvokeFunction except for trusted resources with IAM?

Question

I have been trying to figure out how to create a highly restrictive IAM policy but seem to be running into issues.

We have a lambda that returns sensitive information