There are two types of actions (as you have figured out):
End Users => REST/GraphQL “typical” endpoints => the model controllers and services
Admin Users => The Content-Manager plugin has it’s own internal API which uses different logic but in the end calls the same strapi.query() that the end user services do.
Currently yes, the only way to get a unified set of actions regardless of where the request is coming from is via the beforeX/afterX lifecycles.
Alternatively you modify/create the custom end-user controller and then extend the content-manager plugin controller/service to perform a similar logic.