Changing allow list without having to release a new version

No as the extension is reviewed based on the contents of the allowlist.

I’d go two and use my EBS to control access.

I have a number of released extensions that do 2 with EBS Access Control