Jails / sandboxes such as bwrap could be enough in this case by denying access to e.g. HOME files not explicitly whitelisted.

Also a Little Snitch-like host-based firewall, which would request explicit permission to connect.