Well... you could create a new user profile, install the apps to that user's profile, give their group access to the folders you want the browser to be able to get to (Downloads folder, whatever), then lock them out of anything else....then run the browser as that user only. aka (sudo -u Bob /Applications/Firefox.app/Contents/MacOS/Firefox )

OS perms should do the rest. I don't know if OSX has a firejail equivalent but that would be nice too.