GNU Shepherd itself doesn't implement sandboxing, but you can use the least-authority-wrapper to do namespaces. There are other tools to do more comphrensive sandboxing, which Shepherd can use, e.g. nsjail.

least-authority-wrapper: https://codeberg.org/guix/guix/src/commit/e3fbaeee1386fd447f...