in broad strokes, the auth to connect directly to BQ was painful, required JWT, and I wasn't having any luck with that
so in the interests of time I used cloud functions, which are the google equivalent of AWS lambdas
the cloud function was effectively just a webhook for NS to talk to, and the permissions could be set to access BQ from there because I was already in the google cloud infrastructure....
I guess in NS terms what i did was the equivalent of a suitelet available without login... i just added an API key header auth of my own to make it secure.
i don't recommend doing ANYTHING like this, take the time to figure out the JWT auth and connect to BQ directly and securely.