They don’t need to be actual users. When they’re trying to start Tailscale on a new device have them pass the authorization link to you and open it on your account. This way their devices are registered as devices for your user. You can tag the devices and write ACLs for them to determine what they can access.