Comment by tpetry

That‘s in my experience also the best approach. I wrote an article a few days ago about the exact thing: An integer auto incrementing PK with an UUID you use externally:

https://sqlfordevs.io/uuid-prevent-enumeration-attack