Because of the exceptions you mention, wrapping the majority of your routes in web.php with auth middleware is probably the best path forward.
If this is really bugging you, you could spend some time separating all of your auth routes into their own custom routes file (something like auth.php) but that would probably make it more confusing in the long run.