Seems like you’re on to it already. The advanced way is to run a Multisite configuration, but this is not recommended unless you’re an experienced sysadmin.
The other way is to have some shared SSO between your separately hosted sites. Either one site could work as the main SSO provider for the rest of your sites, or you could rely on some other type of userhub as the parent SSO provider that ties them all together.