Yes, you can do this. Regarding:
Ideally, do this on a backend workflow cause you wouldn’t want to Do a search for emails on the client at the risk of unauthorized access
This state can be returned from the backend WF itself then