Or maybe I"m a little dense.
The videos that are playing without permission are HTML5; in the Sierra version of Safari you get an "Allow?" pop-up when you hit a Flash video. The controlling pref is Safari > Prefs > Security > Internet plug-ins, where I've got "Allow..." and Plug-in Settings > Adobe Flash Player (and SharePoint Browser Plug-in) checked, which results in that pop-up popping up.
I uninstalled ClickToFlash long ago, because its functionality was duplicated in ClickTo Plugin, but CTP's functionality has become unnecessary in the Sierra version of Safari, and I've now uninstalled it, too.
