Keep generated links inside our app's domain?

I have a problem with the auth workflow from a security / trust standpoint.

Let's say I create a new app at my brand new domain: BUY-MY-WIDGETS.COM.

1. User goes to my domain and sees a nice "sign up screen" and puts in their email address and password. So far so good.
2. Now, the user gets some sketchy looking emails from a domain they don't recognize:

3. The user now bails, because they barely trust BUY-MY-WIDGETS.COM, and now I'm asking them to send their browser to God-knows-where.

Ideally, the signup flow should send them to a URL within my own domain. Additionally, the link should be kept as short as possible, so it's easy for a user to inspect for phishing attempts, etc.

Could I generate these links and store them in a table in my database, then write a front-end process to simply read a UUID, look it up in the table, then redirect the app to the stored supabase.co domain?

Is there a better way to cleanly handle this?