Yes, that would be possible. Authenticate users based on them signing messages with their keys, and you can safely see if they are the owner of a NFT or not.