Deploying dacpac through sqlpackage.exe with NETWORK SERVICE user
In the situation you describe, I can't think of anything to do other than add the username / password as secret variables in the pipeline (as you described).
An approach I've used to avoid the username and password thing is to have the Azure DevOps agent service run as a minimally-privileged Windows service account (rather than NEWTWORK SERVICE).  You just have to add that Windows account as a login on the SQL Server instance, and grant it the appropriate permissions for creating and deploying databases with SSDT.
This lets you use Windows auth to connect and deploy to the remote server - but only if that server also &quot;knows&quot; the Windows user (which is probably not the case, as you mentioned the prod server is outside your network - which I assume means it's not on the same Active Directory domain).