Without the API, what you've laid out are the only choices. One refinement I'll point out for the second option, using dummy characters: The token can still be representing their character and configured with their hit points linked to an attribute on their character, but stored as the default token of the dummy character. You can withhold control of the dummy character from them, so only you can drag the dummy character's token onto the board. Once it's there, it will be their token for their character, and they'll be able to interact with it as normal. The only thing you'd gain from the API is the ability to do all the manipulations with a token action or macro without the need to create a bunch of dummy characters. One thing to clarify, if a player has control of a multi-sided token, they can choose the side for it. There isn't a way to lock them out of that.