Hi,
Your approach is classic when it comes to security and data management (don’t duplicate data), and the good news is that you can do it with Hubspot, of course. Take a look at the documentation here.
You’ll notice that you must use serverless functions to do it if your app remains private, and that you can use a mechanism on your servers (my preferred approach as a developer) only with a public application.
You should know that you can create a public application without putting it on the marketplace (so no one has the installation URL) and by implementing a throttling system that prevents it from being used by anything other than your servers (that allows you to sleep well ;)).
Best,