I would go with lua for the players.
You can easily sandbox it, by not compiling in the dangerous functions.
Using debug.sethook you can limit execution by count (https://www.lua.org/pil/23.2.html).
And finally you can bring your own alloc for lua.
There are also decades of articles on how lua works with C and C++, and you can find examples for Rust and others too.
There are also decades of articles on how lua works with C and C++, and you can find examples for Rust and others too.