Hardening against an interactive determined actor is too much trouble for uncertain reward. Hardening against scripted attackers is doable.

Use wayland because why bother with trying to isolate x11.

And use bubblewrap or minijail to jail all applications that parse input not controlled by you directly (players, browsers, viewers etc)

Evict all network interfaces from the default network namespace, if you end up running something malicious unjailed the odds that it will malfunction (or just not be made to deal with) in the absence of an internet connection are good.

Things that need internet connection should join your physical interface network namespace or better yet make namespaces containing just a VPN interface. Through the jail setup script of course.

Use musl, setup a separate void rootfs which will be referenced in the jail setups so that your host doesn't even have most software installed. You can install stuff with a jailed xbps there.