A company wants to publish only one managed backend privately to consumers without establishing full VPC connectivity. Which approach best fits?

1. Choose service-oriented Private Service Connect rather than broad network peering.
2. Reserve an address plan that includes expected primary and secondary range growth.
3. Separate host-project network roles from service-project application roles.
4. Design separate networks or policy boundaries and document allowed cross-boundary paths.