No, really you can't disable all of the services with SIP disabled, at least not the latest Tahoe. Maybe there's a better tool than launchctl, but I don't know what that is. Plus, you disable one, and it crashes and you have to debug it for an hour.

Yes, I'm exaggerating about the networking. Yes, you can lock it down by turning off all of the devices, but honestly, I'm still not 100% on that. It was a surprise to me after I disabled ethernet and wifi and turned off everything in system settings, and someone passed by with an ios device.

However, if you're an expert - please save me a year of trial and error and point me to the minimal list of services and daemons.