[gnufx]

I don't know how effective it is, but firejail can use xpra or xephyr to firewall X.