Even with netns you'll need to run some parts as root, so you'll need to use privsep. Network namespaces are a really cool Linux feature, they're great for using multiple VPNs for different things. But for the average user, I'm not sure if netns has great integration with common desktop environments and it's on the user to make sure they don't accidentally run their program in the wrong/default network namespace.