Have the client own a queue for replies. The client can then pass the address of that queue on the ReplyTo property of the message sent to the ultimate receiver, and the receiver turns around and talks back to that queue. This is a common pattern and why we have that built-in property.
The receiver will also require permission to send back to that queue if you are using this method across SB namespaces (i.e. the reply queue sits in a different namespace) or you're using differentiated access control, i.e. the client only has "send" rights to the target topic/queue and doesn't want everyone to be able to send to its own reply queue.
The way to achieve for the client to pass a short-lived token to the receiver allowing it to send replies is this:
var token =
TokenProvider.CreateSharedAccessSignatureTokenProvider(
[[rulename]], [[key]])
.GetWebTokenAsync([[targetUri]], string.Empty, true,
TimeSpan.FromHours(1))
.GetAwaiter().GetResult();
Have a SAS rule in your namespace or on the reply queue with "Send" permission and use that for [[rulename]] and [[key]]. [[targetUri]] is the fully qualified URI of the reply queue (with namespace). The time span says how long that token will be valid. I use an hour here, but it might quite well be a few seconds or minutes or a day.
You then pass that token along with the message; it can reside in a (custom) message property named like "ReplyToToken".
The receiver picks up the token from that property, and then creates a token provider with it
TokenProvider.CreateSharedAccessSignatureTokenProvider(tokenValue)));
You then create a fresh MessagingFactory using the base URI (no path) of the ReplyTo value and this token provider, and then a QueueClient using the path of the ReplyTo value.
To keep a conversation going, you might then hold QueueClient and factory in a lookup table keyed by the ReplyTo URI and not recreate the reply path every time you get a message but rather take it from the cache.