As a starting point, you could have a look at how theme access is overridden for the theme-creator.discourse.org system:
The allow_theme? method is used in Discourse’s application controller here:
As Sam said, what you want to do is possible, but it will require a fair amount of development work to get it working smoothly