Any inmutable distro with Flatpak will solve this forever. No need to restrict anything.