Is it ok&performant to use Cloud Run as a 'proxy'? Can I adjust the dgraph endpoint to allow only cloud run access it?

I want to use Google Cloud Run as a proxy for the DB, to do my logic to filter spam to auth the user to calc stuff and so on.
I know Dgraph has auth ability and custom javascript code ability (resolvers was the name i think), but I fell better doing it on my own.

Is it ok to do that? if I host DGraph on Google Cloud I won’t have bad performance, or?
is it ok and performant to do what I want? i wont have any bugs or something like that or?

I will of course lose the subscription feature. Is there a way to proxy that subscription feature too?
Because I can’t keep websocket features alive within cloud run, and if I’d still do that with keeping instances alive it would be expensive af.

BTW it will be no problem to adjust the dgraph endpoint so, that ONLY cloud run can access it, is that correct? I know you can do that with the API key, but I want to do that more on a kind of DNS level that 3rd parties can’t even touch the endpoint and brute force stuff or something like that, I want that really ONLY cloud run can access the dgraph endpoint. is that possible?

thanks a lot!! I am a noob