I understand your concern. As a workaround you could potentially create a new Gitlab user that has maintainer access to only the repo that you want to use with the cloud, and no access to the other repositories. This however cannot be a service account because it need to be able to go through our signup process.