It depends on the uploaded file size. You could create an upload endpoint on your server and after checking the file upload it from your server to R2. For small files like images thats a way, but will get impractical for large files.
But all in all you should make a risk assessment what a malicious user achieve when manipulating the upload.