We’ll you’ve got the right idea. Check out A Christmas Hack: Minimum viable approvals. When we get this finalized the principal will be the canister and the sub-account will be the hash of something that you can use to uniquely assign that sub-account to one of your users(or in the example an approver/transferer pair).
I don’t think many wallets have ICRC-1 integrated yet, so your best way to do this to initiate the transaction from your dapp and have your back-end canister take {owner; subaccount;}. Your UI can take care of displaying to the user(show textual encoding if desired). Your dapp can call something like getApprovalAccount in the example to get the proper subaccount to use.
Basically: You shouldn’t really ever have to have an update call take a text string…let the wallet/dapp handle that for you.