Yes, operating system accounts. And a good follow-up step is to check whether that account is really unable to read the files from other accounts. Sometimes Linux distributions come with weird default settings, I think Debian allows read access to files per default. I'm not 100% sure.
Virtual machines are way better at isolating stuff. Downside might be some extra effort to set them up, and maybe some fiddling with the graphics card.