A Software Vendor Is Deploying a New Software-As-A-Service (SaaS) Solution

A software vendor is deploying a new software-as-a-service (SaaS) solution that will be utilized by many AWS users. The service is hosted in a VPC behind a Network Load Balancer. The software vendor wants to provide access to this service to users with the least amount of administrative overhead and without exposing the service to the public internet. What should a solutions architect do to accomplish this goal?

A) Create a peering VPC connection from each user's VPC to the software vendor's VPC.
B) Deploy a transit VPC in the software vendor's AWS account. Create a VPN connection with each user account.
C) Connect the service in the VPC with an AWS Private Link endpoint. Have users subscribe to the endpoint.
D) Deploy a transit VPC in the software vendor's AWS account. Create an AWS Direct Connect connection with each user account.