Jails can be used for this. You can jail a process and only limit what it listens on for example.

  jail -c path=/ ip4.addr=disable ip6=inherit command=/bin/csh

for instance would run the command "/bin/csh" and jail it so that it doesn't get access to any IPv4 and it allows communications over IPv6 only.

So you can use jails to sandbox applications. You can also mount all paths are read-only and only the paths required for the application as read/write. jails can be very handy for all kinds of operations around that, there is no requirement that you provide the jail with a copy of the user land again, although that is the easiest way to run jails.