"Sandboxing" can mean one of ten different things, and the ideal is completely dependent on the use case. I highly doubt the same solution would work for, say, both system services and GUI apps.

Right now, NixOS has declarative containers (based on systemd-nspawn) and FHS-compatible user environments based on bubblewrap (where you bring your own packages; see the pkgs.steam attrset for example).

What do you want out of sandboxing in NixOS?