zzz Private Space in Owner profile should also accomplish this. Works like a secondary user profile, but more convenient UX flow to activate.
Vincent96 Does anyone know if blocking this permission is a planned feature or if the GrapheneOS team have commented on it?