A partner must expose one TCP service to customers whose VPC address ranges sometimes overlap. Customers must not gain general access to the partner network. Which architecture best meets these requirements?

1. Attach all customer VPCs to one unrestricted Transit Gateway route table.
2. Put a gateway endpoint for S3 in the partner VPC.
3. Publish an endpoint service behind a Network Load Balancer and use interface endpoints.
4. Create VPC peering and advertise every provider subnet to each customer.