> How would you do this in a native fashion?

I dunno how GP would do it, but I run a service (web app written in Go) under a specific user and lock-down what that user can read and write on the FS.

For networking, though, that's a different issue.