You don't seem to have much options if canonicals are not possible.
To be honest - in cases like this I wouldn't use canonicals but always go for 301 redirects. They are pretty easy to implement (2 lines of code in htacess) and they are directives Google has to follow (and will pass pagerank). Canonicals are mere requests to Google that it can but is not obliged to respect.
Would also indicate in the Search Console of the duplicates that you're moving them to the main domain (https://support.google.com/webmasters/answer/83106?hl=en) - you need to validate the duplicate domains before implementing the redirects.
Dirk