Anyone know if Cloud IAP can handle at least some of the auth wall use cases in this environment, and how to do it?

I suspect yes, but the last time I checked the Cloud IAP docs (for GAE standard's recent Python 3.7 launch) they didn't yet address the unique situation of second-generation App Engine standard environment runtimes.