The safest way to do it would be to implement it with seccomp so you unconditionally block those syscalls.