Easiest safe method for access control with Degoog?

I've been testing Degoog and got it setup nicely. 2-3 friends have using it via my NGINX reverse proxy. I'm using the "hardened" preset and its bot protection. I'm so paranoid that somebody will start using it which I don't want. The subdomain is obfuscated but you know what bot scanners are like. I trialled Basic Auth in NGINX but its so annoying, credentials expire quickly and the form is annoying to use. Thank you