BLE Connection strategy

[mcan]

Hello.

I have a device (peripheral) with no input / no output capabilities that I want to connect to from a iOS device (central). Still I want the highest security I can get. So Just-works in LE Secure connection mode seems secure enough. But to increase security I also only want it to be possible to pair/bond during a short timespan after some user input (button press). And after that the device shouldn't accept any non-paired devices (centrals) to connect. However, I always want my iOS device to be able to find the device, so I guess advertising must always be on (at least as long as the devices are not connected).

How do I solve this? What modes do I use?

(I have been using iOS devices, but it should work with Android as well)

[mcan]

So my first attempt was to just turn on and off the advertisement, but as I said I need to be able to reconnect without any user input.
Button press + 2 min: advertising.
Other: advertising off.

Next attempt was to try make the peripheral "invisible" by using non-discoverable, limited-discoverable etc. That didn't work because iOS didn't care about that and showed the peripheral whatever discoverable mode it had.
Button press + 2 min: advertising limited- (or general-) discoverable
Other: advertising non-discoverable

Now I'm trying directed connectable instead.
Button press + 2 min: advertising general discoverable, connectable. (on connection save currently connected device)
Other: advertising, directed connectable (last saved current device)
Result: I'm not sure if this works because I get a -5 (I/O error) when trying to start the advertising (something like this):

err = bt_le_ext_adv_create(BT_LE_ADV_CONN_DIR_LOW_DUTY(bt_conn_get_dst(current_conn)), NULL, &adv_set);
if (err) {
    LOG_ERR("Create extended advertising set_id failed (err %d).", err);
    return err;
}
err = bt_le_ext_adv_set_data(adv_set, ad_non_discoverable, ARRAY_SIZE(ad_non_discoverable), sd, ARRAY_SIZE(sd));
if (err) { // <<<--- This is where it fails
    LOG_ERR("Failed to set advertising data (%d).", err);
    return err;
}
err = bt_le_ext_adv_start(adv_set, NULL);
if (err) {
    LOG_ERR("Extended advertising failed to start (err %d).", err);
    return err;
}
LOG_INF("Directed advertising successfully started");

Took inspiration from these two threads (that pointed out that I need to use the extended API):
How to use Directed advertising (high duty cycle) in Zephyr development?
Directed Advertising not seen by the addressed device 

Worst part is that I'm not even sure that if I get the working, I'm not sure this is a viable solution for my problem.