Use firejail, it's a "one click" solution with prepackaged profiles.

https://github.com/netblue30/firejail/

It uses the same kernel knobs as systemd does, but is more user-friendly and has more features.

I use it for every application that handles data received from other machines: books, images, documents, whatever.