Yes, you can do this. Regarding:

Ideally, do this on a backend workflow cause you wouldn’t want to Do a search for emails on the client at the risk of unauthorized access

This state can be returned from the backend WF itself then