A tip for the mechanical side, to make that also a challenge:
[ Spoiler ]
Challenging a hacking group made of overkill
The Vault - an ultra secure matrix system
Access to the system
First, make the Matrix isolated. There's only a sattelite connection to the wider grid, and a timed connection at that (this used to be called vanishing SAN). The node can only be accessed during a window of 5 minutes every two days, after that it refuses all connections on principle; established connections are automatically terminated 23:55 hours into the connection. The system is part of Zurich-Orbital, so an inside job is impossible.
This access node acts as a bottleneck. It's resonse is level 6, tricked out for analyse, where 5 agents with home ground on 4 run analyse (2 analyse, 2 teamwork with the analysing agents, one teamworks with the node, which also runs analyse). All programs and agents level 6. The node has a biometrical lock, so they need the brainwave pattern of a registered user to even access this node (it is 20h hard encrypted, which is very tough, but not impossible (that would be 24h)). Only a registered user may bypass this encryption. Verification is via ultra-secure passkey in combination with biometrics. The node itself needs to be two level 6 commlinks (6/0/6/6) clustered to for a 6(12)/0/6/6 node, to accomodate for all the programs running. Each program is optimised (5), all software of individual agents is made into a software suite that is ergonomic (so it goes against the ergonomic tally, which is a second tally 12 processor for all intents and purposes).
Beyond this, there is a 60/0/6/6 Nexus (you need to route there via the vanishing SAN, so mind your connection time!) where you can access goods. It also has 11 agents on standby scanning the node at all times, 5 teams and one who teams with the node also running analyse. the node also has analyse running. All agents carry the scan pack.
On alert, Level 6 Agents with level 8 combat programs in another suite (not ergonomic) appear and attack any non-Agent icon with black knockout programs, and then run a trace on them.
The Reality Filter Stahlseele mentions is a Level 8 (optimised 5) programm running in the System, enforcing it's iconography on all user who fail their resist test. It's the only high-level program in this setup and mainly a storytelling device anyway.
You can do puzzles with a network of nodes that only connectb for limited time among each other and only randomly, forming an ever-changing maze. A persona needs to occupy a node to keep the connections stable, which makes this thtreaded hacking option often forgotten actually sensible. If you feel like being mean (I would), have IC patrol this maze.
Also, this maze only has a starting point that connects wirelessly, all other nodes have wireless removed and are connecting via hardware. The node behind this maze of nodes is a Nexus full of whatever the players are looking for.
Another idea would be ultra-secure access as detailed above. If you need a specific commlink with a built-in codekey and a specific brainwave pattern AND to connect at an exact time to identify yourself to a live spider, getting whatever is needed to hack in becomes a run in itself.
And if the mancer hacks via resonance quest, have his character overwhelmed by Novatech during that quest and used up in some sort of twisted experiment, because that is just not done.

If you're purely going for a weird, otherworldly matric place, try a resonance quest.