Can you recommend any distros that use it extensively, or is it too early?
Ideally upstreams, rather than distributions, should sandbox their own projects.
However, Debian is shipping a number of hardened systemd unit files.
To see some examples on how the sandboxing is being set up you can grep for SystemCallFilter, CapabilityBoundingSet, ProtectSystem, ProtectHome in /lib/systemd/system/*.service
Proper, very strict sandboxes implemented with seccomp & friends are much more secure. You simply block the large majority of system calls.
Surprisingly, they are often easier to set up.