Authentication for Collection without email

[leesei]

I would like to create a collection without email (say "newbs").
They can create content in another collection (say "posts") after login (in my frontend app which calls the API for them).
They cannot login to AdminUI or otherwise change the data.

I thought my use case is similar to #1196 and asked for samples of adding passport strategy.

I think I can handle the authorization part (for posts collection) once the newbs logged in and I can get the user in Payload CMS's backend.
Is there better way to implement my requirement?