I think in the time you got all of this working, you probably could have read all of https://nix.dev and nix pills, and be in a better position to make all of this work on nixos, but that’s just like my opinion, man.
If you just want to sandbox the disk, maybe bubblewrap is easier? Maybe if you want to dynamic firewall you can run opensnitch, and then you can cut internet access a bit more dynamically? agent sandboxing is something I think there is lots of space to do great things with nix, again, just haven’t had the time to invest. Partial rootless overlay store in container? - #2 by tehmatt might be interesting to you?