Your company runs an internal SaaS analytics platform published by a partner organization as a Google-managed published service. Your security team mandates that traffic to this service must never traverse the public internet, must not require overlapping or coordinated RFC 1918 IP ranges between your VPC and the producer's VPC, and must be reachable via a private IP address that you control inside your own subnet. Which connectivity method should you design?