with Tailscale Lock you have a lot more control, you can also self-host your coordinator server which is an alternative even mentioned in the service docs[0]

[0] https://tailscale.com/kb/1226/tailnet-lock