You could also wrap your cart.liquid in code that checks if the user is logged in, and if not it redirects them to the login page. This would need some testing as I’m not sure their products would stay in the cart after login (I assume they would). But that way the cart can’t be accessed unless they’re signed in and you can check their tags/metafields/orders.
But this isn’t a great experience for customers and could hurt your conversion rates.