I hear you. I was hoping you might find a smart way for your processes, but I do get the challenge.
There is one more thing: The Werk you quote already states, that the user used for the registration process does not have to have full read/write access to all hosts. It is possible to use a user, that can only access hosts based on their contact groups.
Again it depends on your specific environment, if that scales for you, but at least security-wise this is way better than full access, and you are empowered to decide which approach you want to pursue.