You can do better than entirely separate accounts. You could use a user namespace (i.e. subuid/subgid) for sensitive data.