Thank you for the answer and suggested approach. This is more or less exactly what I have implemented now.
Each of my clients logs into the developer portal with their user account. Using the management api the developer portal creates new 3rd party applications. I opted for the slightly hacky approach of encoding the originating user in the 3rd party application name. (maybe there is a better way or you can support some sort of tagging of applications in the future?)
For example:
The user has an id of “auth0|12345”. When the user creates a new application in their developer account of name “User App”, then I create the 3rd party application (M2M) with name “auth0|12345|User App”.
This allows me to associate those applications with different user accounts without needing my own database which may go stale.