Not a complete answer (by any means) but keeping tight control over egress network access helps (I wish it was easier to limit egress access over port 443).

Systemd has some capability to restrict access to system resources. I haven't experimented with the capabilities yet so not sure what's all there.