A private workload should access selected Google APIs but not gain broad internet egress through a NAT gateway. Which approach best fits?

1. Treat Cloud Router as the managed control plane, not a data-plane forwarding VM.
2. Use an appropriate public frontend or load balancer rather than relying on outbound NAT.
3. Use an appropriate private API access design with explicit egress controls.
4. Review NAT port allocation and scale the available translation capacity.