That's really interesting, I had no idea systemd could do that. Have you written in more detail anywhere? I'd love to see a detailed comparison between approaches.
Have a look at these in systemd.exec[1]: PrivateUsers, DynamicUser, ProtectProc, RootDirectory.
There are more, but these are the main ones.
[1]: https://www.freedesktop.org/software/systemd/man/systemd.exe...