Just return the verbose message and save your finite time for more important things.

Does returning specific internal error codes can help attackers in their penetrations attempts?

Yes, but (hopefully) not to a meaningful extent.

How can the verbose error message hurt you?

Actually none of your mitigations prevents some timing attacks. Here is a simple timing attack. Let's say you are comparing a password string to a password string like this:

$password = "bobcat"

The way the computer checks this is:

  for char2 in "bobcat":
    if char1 != char2:
      break

Now, if i send the password "p", and it fails slower than if I send the password "a", I'll know the first character is "p".

Now I just need to loop through the rest of the alphabet until I get the rest of the characters.

If your errors are timing attack resilient, don't worry about the verbosity.

Yes, Yes, return meaningful errors

Security is hard enough. Make the developer or user experience easier. In this case, the tradeoff is minimal.

Does returning specific internal error codes can help attackers in their penetrations attempts?

Yes, but (hopefully) not to a meaningful extent.

How can the verbose error message hurt you?

Actually none of your mitigations prevents some timing attacks. Here is a simple timing attack. Let's say you are comparing a password string to a password string like this:

$password = "bobcat"

The way the computer checks this is:

  for char2 in "bobcat":
    if char1 != char2:
      break

Now, if i send the password "p", and it fails slower than if I send the password "a", I'll know the first character is "p".

Now I just need to loop through the rest of the alphabet until I get the rest of the characters.

If your errors are timing attack resilient, don't worry about the verbosity.