I've built software used by EU governments, and we don't use a cookie banner for our login cookies either.

If your legal team genuinely suggests that, it's likely your company uses the login cookies for some additional purposes.