If you see no access even as root as problematic, why are you avoiding disabling SIP? That sounds like exactly what you want.
As a last resort, that is what I will do. But that would mean to fight the system, which is rarely a good thing in the long run. When it comes to system setup, I prefer to color inside the lines if at all possible.
"Configuring which programs a restricted user can run" is _such_ an elementary task for an OS that I cannot believe that recent macOS has no provisions for that. I _must_ be missing something.
I've been trying unsuccessfully to childproof a Big Sur laptop for a 12 year old for some time now — disable access to some built-in apps etc. I have yet to figure out how, without resorting to disable SIP.
There is Screentime, but that's an unreliable joke which has caused us a massive amount of headaches on iOS due to unreliability, has very limited features and can only be protected by a 4-digit PIN.