Recommendations to set up complex permissions site and library

We have a process in SP2016 where one collection has about 200 subsites and another similar collection about 50 subsites. Each subsite is for 1 user, some profile data, and their documents. A couple times a year a group of subsites need to have read access for three other employees (3 different per subsite, not 3 for the group of subsites). After about a month, these permissions are removed. This is a very manual process. This system needs to be converted to SPO, but subsites are not permitted and since the subsite template may change, does not seem appropriate. My process has been to create a record per user, linked to a folder per user and accessed via a PowerApp. I have some workflows to help manage permissions, but it's not comprehensive yet. I'm interested in finding out how someone else would tackle this migration, keeping in mind that ultimately it is managed by non-tech HR staff. Thank You!