One of the biggest challenges while developing the game was completely abandoning the traditional mana system and enabling the player to use their own health (HP) as a resource. Here is how I validated this state server-side using Netcode for GameObjects (NGO).
When the Client (Antibody player) wants to play a card, they cannot directly subtract from their own health. Instead, they send a ServerRpc to the server.
ClientRpc.Thanks to this asymmetric setup, we successfully prevented client-side cheating!