RuntimeException

All of the above is incorrect. You have to use some middleware magic. I finally got it working properly with the following:

bncreports.services.yml

bncreports.secure_district_middleware:
    class: Drupal\bncreports\RedirectMiddleware
    tags:
      - { name: http_middleware }
bncreports.secure_district_subscriber:
    class: Drupal\bncreports\SecureDistrictSubscriber
    tags:
      - { name: event_subscriber }

namespace Drupal\bncreports;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpKernel\HttpKernelInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;

class RedirectMiddleware implements HttpKernelInterface
{

  /**
   * The wrapped HTTP kernel.
   *
   * @var \Symfony\Component\HttpKernel\HttpKernelInterface
   */
  protected $httpKernel;

  /**
   * The redirect URL.
   *
   * @var \Symfony\Component\HttpFoundation\RedirectResponse
   */
  protected $redirectResponse;

  /**
   * Constructs a RedirectMiddleware
   * object.
   *
   * @param \Symfony\Component\HttpKernel\HttpKernelInterface $http_kernel
   * The decorated kernel.
   */
  public function __construct(HttpKernelInterface $http_kernel)
  {
    $this->httpKernel = $http_kernel;
  }

  /**
   * {@inheritdoc}
   */
  public function handle(Request $request, $type = self::MASTER_REQUEST, $catch = true)
  {
    $response = $this->httpKernel->handle($request, $type, $catch);
    return $this->redirectResponse ?: $response;
  }

  /**
   * Stores the requested redirect response.
   *
   * @param \Symfony\Component\HttpFoundation\RedirectResponse|null $redirectResponse
   * Redirect response.
   */
  public function setRedirectResponse(?RedirectResponse $redirectResponse)
  {
    $this->redirectResponse = $redirectResponse;
  }
}

namespace Drupal\bncreports;

use Drupal\Core\Url;
use Drupal\user\Entity\User;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpKernel\Event\RequestEvent;
use Symfony\Component\HttpKernel\KernelEvents;

/**
 * Prohibit access to other districts
 */
class SecureDistrictSubscriber implements EventSubscriberInterface
{
  /**
   * @param RequestEvent $event
   */
  public function secureDistrict(RequestEvent $event): void
  {
    $current_user = User::load(\Drupal::currentUser()->id());
    if ($current_user->hasRole('administrator') || $current_user->hasRole('bnc_operator') || $current_user->hasRole('ao_user'))
      return;

    $district_id = $current_user->get('field_district')->value;
    if (!$district_id || strtolower($district_id) == 'all')
      return;

    $pathInfo = $event->getRequest()->getPathInfo();

    $middleware = \Drupal::service('bncreports.secure_district_middleware');

    if (preg_match('/\/users\/\d{3}(\d|[a-z]|\-)/', $pathInfo)) {
      $params = explode('/', $pathInfo);
      if ($district_id != $params[2]) {
        $url = new Url('system.403');
        $response = new RedirectResponse($url->toString(), 301);
        $event->setResponse($response);
        $middleware->setRedirectResponse($response);
      }
    } elseif (preg_match('/\/users/', $pathInfo)) {
      $url = Url::fromUri('internal:/users/' . $district_id);
      $response = new RedirectResponse($url->toString(), 301);
      $event->setResponse($response);
    } elseif (preg_match('/\/user\/\d+\/edit/', $pathInfo)) {
      $params = explode('/', $pathInfo);
      $user = User::load($params[2]);
      if ($district_id != $user->get('field_district')->value) {
        $url = new Url('system.403');
        $response = new RedirectResponse($url->toString(), 301);
        $event->setResponse($response);
        $middleware->setRedirectResponse($response);
      } elseif (!$current_user->hasRole('district_poc') && $current_user->id() != $user->id()) {
        $url = new Url('system.403');
        $response = new RedirectResponse($url->toString(), 301);
        $event->setResponse($response);
        $middleware->setRedirectResponse($response);
      }
    }
  }

  /**
   * Listen to kernel.request events and call secureDistrict.
   * {@inheritdoc}
   * @return array Event names to listen to (key) and methods to call (value)
   */
  public static function getSubscribedEvents(): array
  {
    $events[KernelEvents::REQUEST][] = ['secureDistrict'];
    return $events;
  }
}