I want to distribute tokens to users by verifying some data they provide to a DApp (for example, matching their camera photo with the database containing their faces). Since there will be thousands of users, given the high GAS costs, I cannot register each user within the smart-contract given the money constraints and the amount of data I need to store.
What is the best approach, if any, to prevent cheaters obtaining more tokens using some other DApp? I assume that somehow, the smart-contract needs to know which DApp the data is coming from... but I don't know how.
Furthermore, I would prefer if the solution involved just one smart-contract without asking me to change the state of a contract for each user. Also, I do not want the users to have to deposit ETH but only to pay the transfer fees obtaining their tokens.