Advanced Auth Checks

I've set up my NextJS app to work entirely with Supabase's Auth abstractions (react components & auth helpers). I want to start adding a bit more control to our Auth flow. I have 2 basic requirements:
1. We have a multi-tenant setup, so I want to make sure users are only logging onto the servers they can access.
2. We have disabled sign ups for security purposes. In cases where users are trying to access tenants that they _should_ have access to (ie. defined as an email <> domain match), we want to override the GoTrue Sign Up only rules [here]( (or alternatively, just create the user using supabase admin privileges).

Ideally, this is done in our application to avoid having to write a trigger policy and run migrations every time we want to add a client / update the rules.

Is this possible with the current abstractions? It seems I would have to redirect the /callback functionality to a custom path / function. Is that possible with GoTrue env variables?