The basic idea is good; I'm not convinced Squid buys you any security, though. If everyone can operate that way, consider allowing access via SSH only.

Oh, and don't forget chroot (or something more modern, like jails or even SElinux).

Having said all of the above, for the typical startup, the main threat is not an attack on the server but some shoddy application code committed under yet another tight deadline.