I don’t think in this a good use case for the (to be contributed) Access Control Backends.
What I would do is to refactor the Enrollment API to match your needs. I usually get away with such hard-coded changes in the platform core by writing new tests and surround my new code with feature flags so it survives release upgrades. Sometimes it doesn’t survive but it breaks loudly – thanks to tests – which makes it easier to fix.
Can I just say that I absolutely love the fact that you took the time to create great docs for this plugin? I am looking forward to a stable release that will support single site setups.