The current suggested solution is to create a new user just for that repo and create a PAT in that user. So the PAT will only have access to that repo.