Can run it in a isolated namespace and communicate with unix sockets. If the service does not support listening on sockets you can use socat within the namespac

Can run it in a isolated namespace and communicate with unix sockets. If the service does not support listening on sockets you can use socat within the namespace to forward from the unix socket to a port on lo in the namespace. Most reverse proxies can forward to a unix socket. I've done similar things (and sometimes with a wireguard tunnel out to internet) for privacy reasons.