Consent Mode decides nothing by itself. It listens to whatever your consent management platform hands it. You still need a CMP, with a valid banner, a refuse button as easy to reach as the accept button, and a way to change the choice later.
The default status has to be denied before the banner loads. Skip that and there is a window with no status at all, in which tags fire as if consent were given. In gtag you set it with a consent default call at the top, with wait_for_update so tags pause briefly for the banner's answer.
In Google Tag Manager your CMP tag belongs on the Consent Initialization, All Pages trigger, which runs before All Pages. Put the banner on an ordinary pageview trigger and the order inside the container decides who goes first, which is rarely your banner.
The trap we see most often is a tag hardcoded in the source, outside the container. It knows nothing about consent state and fires before the banner exists. Open the network tab and check whether anything leaves for Google before the first click on the banner.