First time message/popup in site (by cookie), Googlebot and SEO

It's not possible without some form of batman and robin cloak

There is absolutely no way without some form of cloak to prevent Google seeing that pop-up. Google expects you to treat Googlebot as new visitor every time. Just because Google doesn't store a cookie doesn't mean you should treat them as a returnee.

Google has to consider both new visitors and the returned

Google has to factor new visitors since the majority of your visitors coming from Google will be 'new' visitors, why should they care about returnees that may not even use Google to view your site.

Visiting your favourite site to find some obscure content is a like putting on your favourite t-shirt only to find out its still damp

Purposely obscure content dampens users experience and one of the reasons why preventing Google seeing that is definitely cloaking, regardless if its once, or a hundred times, Google has new visitors to factor. However it should be noted that Google has not officially said that such overlays, modals and popups will result in lower rankings on the desktop environment, this does not however insist that they don't already have some form of unconfirmed algorithm, or add it later.

Mobile Only: Google has stated that in 2017 it will rank such sites lower

SOURCE

Pages that show intrusive interstitials provide a poorer experience to users than other pages where content is immediately accessible. This can be problematic on mobile devices where screens are often smaller. To improve the mobile search experience, after January 10, 2017, pages where content is not easily accessible to a user on the transition from the mobile search results may not rank as highly.

Your two choices are:

  1. Cloak it using user agent, hostname or IP
  2. Remove it for both users and search engines