Session-based invite codes for users without sign-in

Also I have concerns about the security of this. Don’t I need row owners to be set on the Invites table containing all the invite codes? This old post below seems to suggest that without Row Owners enabled, all the invite codes will be downloaded to the end user’s device before the check is done? Or are you saying that I only need the Guests table to not use Row Owners, but it’s OK for the Invites table to use it?

Essentially I need the Invites table to be unreadable to users who aren’t logged in, whilst still being able to cross-check the validity of a particular invite code provided by a guest against the list of valid codes. This means the check needs to be done server-side, but I’m not sure if that can happen when using USC values?