Is this possible? If so, is there any guidance on how to achieve this?
Thanks
On the frontend side, when you install a module, it loads the .js file (using a regular <script> tag) which contains a single function. The Odoo core passes its main JS object (the base of the core API) to that function, which then initializes the whole module and uses the Odoo API to configure stuff, setup hooks, etc.
There's no security, though: by design, a module is trusted and can do anything on the platform. I'm not sure if and how one could contain them.
(Disclaimer: I'm a developer working for an Odoo partner, we write modules and host it as a SaaS.)
When you say "language" here, are you referring to the web languages (HTML, JS)?