While that is possible. You do have to go out of your way to do that in ways a typical user wouldn’t.

Aside from that like others have said. Just don’t give sudo perms and have them use Flatpak.