This is the approach I use. Aside from my main account, I have a separate account Steam, a separate account for Wine applications and another account for miscel

This is the approach I use. Aside from my main account, I have a separate account Steam, a separate account for Wine applications and another account for miscellaneous applications. I have an iptables rule that I use to selectively disable network traffic from applications I don't want/expect to communicate with the outside world and disable cron and atd to reduce the avenues for persistent applications.