You don't necessarily have to enable `allowUnfree` entirely. There's also `nixpkgs.config.allowUnfreePredicate` which lets you define a predicate that takes a package and decides if it's okay to install.