It seems to me that mounting everything user-writable as noexec should be very similar to what you want. That said, it will not prevent a user from executing ar

It seems to me that mounting everything user-writable as noexec should be very similar to what you want. That said, it will not prevent a user from executing arbitrary code, but will make it much more complicated than "download this bunary and click it". (It's still possible to use a debugger to load something into an existing process; IIRC you can LD_PRELOAD a library from a noexec location, etc.)