Unix file protection with owner/group is OK too. But would you create additional users and groups for running software? With OpenBSD’s pf, you can add network rules for each user.