A systemd conceptually is quite a good idea. However systemd is not that systemd. Much rather go with rc.conf + script approach, disable all systemd services, lock selinux against systemd socket activations and run a purpose controlled environment. Avoiding systemd does force one to not use Linux as a desktop..oh well.