Is there a convenient way to sandbox non-appstore apps?

It's a real chore to figure out what apps that aren't available through the appstore (Chrome, VSCode, etc.) are doing to my computer. So much so that I'd rather just castrate them by default and deal with breakage later.