How to send service emails via Gmail (machine-2-machine) with secure restrictions?

Question

How to send service emails

• from my backend with smtp.google.com or Gmail API while making sure
• the secret stored on the backend server can only be used to send emails from a specific sender?

Goal

• send user account activation emails from my backend
• use smtp.google.com or Gmail API (i.e. no own SMTP server)
• authenticate with OAuth2.0 (i.e. don't enable "less secure apps")

Current state

• implemented the email sending part
• for testing, I created a noreply@**.** Google Suite account
• for testing, I generated an accessToken via OAuth2 Playground
• using the accessToken I can send emails via smtp.googl.com

Problem

• Google suggests to use a service account for this
• But to send emails from [email protected] I have to enable Domain-wide Delegation
• Domain-wide delegation allows to impersonate every domain account
• the secret stored on the backend should only allow to send mails from no-reply@**.**