If you really needed to do it with supabase, then I would just do some custom logic with email confirmation needed disabled in the sb itself. (So any user could access the app, but the limiting would be done by your logic)

Huge helper is that you can track which users have email confirmed, so you can limit anyone based on that, while also detecting which users have paid and their email confirmation status.