What's the best way to allow logged in users in AEMaaCS websites?

We have a requirement here where customers would log into our AEM dispatcher website, and then allow them to read Closed User Group content.; view assets from the DAM. What is the best way for doing this?

Please imagine that we currently have over 3,000,000 subscribed users. On a monthly basis, we may get 10-100 new ysers. These users when logged in, they view content content set by the CUG configurations of AEM.

However, I am not keen on registering users in the publishers... but we want to use the CUG configurations of AEM... how would we achieve this?