As Samir mentions above this is what we do today in Katello. The part that is a bit painful on smart proxies is that we’ll need to figure out now what hosts have access to what content, which could mean adding even more to the container gateway. Thankfully we moved from sqlite to postgres, so the performance should be better, but I wonder if we could somehow match hosts to flatpak repos without storing a host<->repository cache on the smart proxy itself. So far everything I think of is more complex than just syncing a host to repo mapping from Katello to the smart proxy.
At least, if we move to certificate authentication, we can avoid also storing a map of IP addresses on the smart proxy as well. We would just need to store consumer UUIDs.