In case you want to avoid bonding and if you have access to the device code and want a stable identifier, you could also expose your own identifier via the custom advertising data.