Custom access for a web-based custom type

For my Drupal site, I made a custom type named MyCoolCustomType. I'd like to grant access to view this custom type only to certain condition on user role and properties of the custom content itself (for example, the ModerationState of the content).

I'm quite confused about how to process.

Thanks to a class that extends RouteSubscriberBase, I'm trying to modify the route entity.node.canonical to change the requirements part. In this part, I'm going to use a dedicated service for _custom_access.

Where is a good place to filter only MyCoolCustomType, a service or a subscriber?

Looking at the route subscribers implemented by a Drupal core module, the Drupal\content_moderation\Routing\ContentModerationRouteSubscriber class alters the routes in its setLatestRevisionFlag() method (called by ContentModerationRouteSubscriber::alterRoutes().

// Only set the flag on entity types which are revisionable.
[$entity_type] = explode('.', $entity_form, 2);
if (!isset($this->getModeratedEntityTypes()[$entity_type]) || !$this->getModeratedEntityTypes()[$entity_type]->isRevisionable()) {
  return;
}

$parameters = $route->getOption('parameters') ?: [];

foreach ($parameters as &$parameter) {
  if (isset($parameter['type']) && $parameter['type'] === 'entity:' . $entity_type && !isset($parameter['load_latest_revision'])) {
    $parameter['load_latest_revision'] = TRUE;
  }
}

$route->setOption('parameters', $parameters);

Essentially, that code first verifies the entity type is one the module handles and then alters the route definition.
The same should be done from your code: The route subscriber verifies the route is for an handled entity, and then calls $route->addRequirements() to add its own _custom_access.