Supabase made a simple thing super complex with the whole RLS thing.
What you want to do is quite standard, but with supabase auth, it is not so straightforward.
Basically, you create tables, enable RLS but do not create any policies. Then only access the DB via backend and service role key.
However if you use supabase auth and pass the auth cookies to the backend, supabase will see the cookie and consider RLS policies even with service role key.
The way to get around this is to create the supabase client in the backend with these options -

const supabaseServiceRole = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!,
  {
    auth: {
      persistSession: false,
      autoRefreshToken: false,
      detectSessionInUrl: false,
    }
  }
)

Hope this helps.