How to send ERC20/721 tokens as Custodian for someone else?

Let's say we create multiple wallets (via HD-Wallet) for our users, so they don't have to care for their private keys.

The users will only have access to their public wallet address to receive Ether or ERC20 or ERC721 tokens.

But there will be some point when we have to transfer ERC20 / 721 / 1155 tokens from their wallet onto another wallet on the user's behalf.

When using custom smart contracts, we could add functions that allow a specific operator wallet to do so. But for the conventional contracts, there is no function (and approve is not an option here because it also requires gas).

We can obtain the required private key for every single wallet thanks to the nature of HD wallets. But we have to pre-fund these wallets with Ether to pay gas fees, and I am looking for the best way to do so:

  1. estimate the gas fees for the corresponding "transferFrom"-Method of the smart contracts
  2. send Ether according to this estimation on the wallet
  3. try to sign and send the method call to the Ethereum node
  4. if it fails because gas fees were rising, return to step ยง1 and add 10 percent on top for pre-funding or something like that

I learned that using the defender-Relayers will also not help without further preparation of smart contracts.

Do you guys follow the same approach, or is there something that I don't have in my mind yet which would be a better approach?