Google Pub/Sub client in 3rd party environment

I am building a backend service that would communicate with clients with pub/sub. However since clients would run in the 3rd party environment I am not sure how to secure it. In controlled environment I would just create a service account but since this is more like a Saas environment I am not sure how many clients there will be (GCP has a limit of 100 SA). What is the best way to handle it?

thanks