By far the easiest place to tap into CAN is behind FRM.
Just above foot rest there is a thick bundle of wires. PT-CAN and K-CAN are spliced there from factory. Wires are twisted together and all you have to do is remove the plastic insulation.
Bear in mind that there is more things splined there. What you need, are twisted wire pairs with colors as in the picture.
I run those wires to OBD2 connector. I added pins and I am reading DCAN, PTCAN and KCAN using comma.ai Panda.
Also, I started
openDBC repository for E-series that can be used in Cabana. I wonder if E8x CAN is the same as E9x...