Host a DNS Subdomain without Active Directory Integration

We have a use case where we want to have a subdomain controlled with automation, which is only creating CNAMEs to the active directory DNS. We want to limit access to the Subdomain and provide no read/write access to the Active Directory DNS from the automation system.

I have two choices:

1. Try to keep this in AD as a zone, but (somehow?) ensure it's not in any way connected to the Active directory DNS records
2. Host a *nix based BIND server to host the CNAMEs. Then set this server as authoritative for the DNS subdomain

Has anyone tried to do something similar?