You can just run QuickJS (without std lib) as a separate process running as an unprivileged user with seccomp rules.

WASM probably doesn't add much there.