There are ways to prevent users to run any kind of executable from $HOME.
Re:An update on GNU performance
by yjftsjthsd-h on Monday October 22, 2018 @09:21AM
(#18274377)
Oh, you have a policy problem rather than a technical problem. In that case, I'm not sure how it would help to have a system where user control was normal, since invariably it would be locked down in exactly the same way. I don't think HURD will prevent mounting /home with noexec.
The future is today:) Nix is a package manager that can run without root. Gentoo prefix installs are an option. Or if you want something more traditional, proot can run a decent number of distros. Maybe also fakeroot? Haven't tried that personally.
No idea if there's a FUSE module for NFS/CIFS, though sshfs is a thing.