[neop1x]

It's easy but very inconvenient. Drop sandbox [1] or Docker are much more convenient alternatives to user/group isolation for this purpose.

[1] https://github.com/wrr/drop