Honestly this is one of the best use cases for multiple profiles on a device.

They want entrance, just grant it to a sandboxed environment.