A SaaS provider (the producer) runs a managed data-processing service in their own VPC. For certain workloads, the producer's service instances must initiate outbound connections into a customer's (consumer's) VPC to reach an on-prem database exposed through the consumer network — while keeping the traffic on Google's backbone and avoiding VPC Peering, which would create IP overlap and full route exchange. The producer wants a network interface that lets their instances originate traffic into the consumer VPC with controlled, one-directional reachability. Which Private Service Connect construct should the producer use?