No modules, no special settings, just enabled Magisk Hide. Granted, I'm still on Marshmallow with a much more limited custom ROM and a non-Nexus device - I can't guarantee things will work the same with newer versions of Android. Still, my Fire Emblem: Heroes profile hasn't nuked itself and the SafetyNet check app I have still returns success whenever I try it.
Looking at the Magisk changelog, I'm still a few builds behind the current one, but from the build you're using it looks like you should be able to use modules and still pass SafetyNet.