A "normal" NixOS system will only give you a full sandboxed isolation for apps at build time and not a runtime. nixpkgs (the thing packaging the stuff for NixOS

A "normal" NixOS system will only give you a full sandboxed isolation for apps at build time and not a runtime. nixpkgs (the thing packaging the stuff for NixOS) provides packages for apps similar to Debian afterwards and not flatpak in terms of runtime isolation (if I understand your use case). My recommendation would be to test it out and look at how it does things. Maybe checkout the live installer with a gui to get a feel for a desktop system.