Hi @kyle3,
Welcome to the Community!
It would work, but they would essentially be acting as the SPA, regardless of what app they were making the request from. It would certainly be a bit of a workaround solution.
This would be the most logical way to do it. Give them their own client credentials, the same way you would give out an API key. You can create and delete M2M applications programmatically using the management API, but this will require some setup on your side, and you would need to build out the UI for this feature (if required).
Granted, there are now entity limits that you will have to deal with, so picking the right type of subscription is important.
This is something that has seen some debate on the forum recently and if you could submit a feedback ticket about your use case and needs to our product team we would appreciate it.