Similar to the anti DDOS of cloudflare serve a verification page that makes the browser wait based on this method: https://github.com/kkuchta/css-only-chat#receiving-data then add HTML code for verifying if it's a real browser and finally if the browser reach the antibot resource redirect to the real content with a 302 or delete all the HTML code if possible then serve the real HTML content of the program proxied.
Store in a cookie or/and whitelist temporally the IP if it's a real browser.
Or if the client fail multiple times ban it.