Yup and for outgoing traffic firewalling rules can also be put in place to only allow users authorized to emit traffic. Drop or reject anything by default, then

Yup and for outgoing traffic firewalling rules can also be put in place to only allow users authorized to emit traffic. Drop or reject anything by default, then only allow some users to send packets (like "john" and "_apt" [to update packages], etc.). It's not incompatible with the other measures you described. FWIW I also log, for every "user" on the system, anything from a user that's not supposed to access the net.