Comment by OriginalPenguin

My experience with any built in sandboxing for these command line tools has been awful.

What I've done instead is built a script to create a disposable virtual machine (using incus to manage it).

And then I just run the CLI inside the virtual machine and delete the vm at the end of each day.