There’s a way to direct dns challenges to a dns server just for the dns acme challenges: https://blog.bryanroessler.com/2019-02-09-automatic-certbot-...

No need to give broader access