Thanks @Osiris!
It is true that overly modifying the security configuration of the server to accommodate one browser is not best practice to say the least. And is not recommended.
Frankly, I forgot to ask about the version of Safari, and it's an important answer to know.
Could it be the fault of MacOS 10.10 and not Safari itself? The SSLLabs clients tested are Safari 8 on MacOS 10.10 or Safari 9 on MacOS 10.11. So with aid of SSLLabs we can't distinguish MacOS or Safari..
Also, MacOS Yosemite 10.10 isn't supported any longer according to Wikipedia: Support status
Unsupported as of August 2017.
Anyone with Safari 10 but MacOS 10.11 who can reproduce this error?
It's your choice: do you add less secure cipher suits so your site supports unsupported browsers/OSses? Or do you upgrade your browser/OS? (Probably OS in your situation.)