If it’s just quality and security, upload the 0.0.0.dev123 code. No one should expect that to be any good, or secure, and it should be OK on PyPI as long as it isn’t outright malicious.
As for permanence, you can delete a release later. (Though you don’t really need to – if you’ve flagged it as not ready, no one should blame you for any bugs.)
If their uploads are malicious or mass-registered, they’d be violating acceptable use policy and it should be relatively straightforward to get them taken down.
There can be moderation delays though, so ideally have these projects registered before announcing a release date – even if that means uploading projectname-physics 0.0.0dev0 that only implements collision with ground at y=0.