> The next step is to isolate the Windows applications: you could use different WINEPREFIX,

In case you're not aware, wine prefixes each use their own settings, but are not isolated from one another.

https://gitlab.winehq.org/wine/wine/-/wikis/FAQ#how-good-is-...

> but I think the better way is to do it like android: one "user" per application.

This would help somewhat, assuming you don't run them all in one user's X session. On Linux, some desktop environments have a "switch user" action to start a separate desktop session running as another user on another virtual console. You can switch between them with Control+Alt+F2, etc.