This is exactly what it means - it doesn't explicitly prohibit a business to deny service; however in this case the regulator is likely to rule that the consent they received from those users who did click "agree" was not freely given, and the business is using their data in violation of this directive.

I.e. instead of "can a business deny service, or offer degraded service instead, if no consent is given" think about the concept "if a business is known to deny service or offer degraded service instead if no consent is given, is that consent freely given or not?", and how will your business demonstrate to the regulator the legal basis that gives that you have the right to use that data - since now by default you're not allowed to have and use it. The evaluation criteria is not "did they click a box with required parameters" but rather "does your whole consent-gathering process ensure that you're not counting consent that users did not want to give" - if your consent-gathering process is flawed and systematically results in people who didn't want to consent being listed as "True" in your consent-database, then it means that you don't have consent from anyone.

This is an clear, large financial risk, since if a business does it this way I'm likely to intentionally go to their website, click 'Agree', enter my data, on the same day file the standard request to the business requesting information of the data they have on me and the legal grounds for using that, and if all they've got to say is "well, you clicked the agree button where the other choice was to refuse service" then I'll immediately file a complaint with the regulator that they're using my data without freely given consent (as the service was conditional on that consent) and deserve a fine for this violation. And the fines are substantial.