Is it possible to only surface the ATT prompt to users coming from paid ads?

No, unfortunately this isn't possible. In order to know IF a user is coming from a paid ad, by definition you need to have done some form of 'tracking them' (as defined by Apple's policy) first.