If you want to properly isolate the network (veth device, separate IP(4/6) address) you need at least a suid helper to attach that to a bridge, it can't be done

If you want to properly isolate the network (veth device, separate IP(4/6) address) you need at least a suid helper to attach that to a bridge, it can't be done with userNS alone. Userspace proxying are a kludge and don't provide all the tools that the kernel network stack does. That said, if you're using userNS then certainly the main executable should not be privileged, only some specialized helpers. And of course it should use caps instead of suid.