I just realized I didn't thank you for this, so thank you!

You can always do: ls /usr/share/sandbox and look at the numerous examples to figure out how to specify details ;-). If you have Microsoft Office installed on a macOS, looking at Activity Monitor and going to View -> Columns -> Sandbox you can see Microsoft sandboxed all their apps...wonder how they did it? Microsoft must have thought it was still useful security measure.