Yeah, you should probably use a sub domain anyways, but - Could you embed a noindex meta tag in the html of the page or the header in the response for each use

Yeah, you should probably use a sub domain anyways, but - Could you embed a noindex meta tag in the html of the page or the header in the response for each user controlled subdomain? That should make it so google won’t crawl any of those pages, even if they’re submitted to console