I think you could do it somewhat like hetzner does for their storage boxes. You get an account that has read and write access to a directory and nothing outside. The accound can only run a limited set of commands, like ls, cat, nano, rsync etc. but has no access to commands that modify the filesystem.

Then you can use a copy on write fs like btrfs and make scheduled staggered snapshots.

I usually do 1x per year, 1x per month of current year, 4 per week of current montg, 7 per day in current week.

I have no clue what they use to limit the user accounts like that btw. but maybe that gives you a new jump off point for further research.