Regarding your first thought, you can get pretty close today with Windows Isolated App Containers. Chromium uses this under the hood.