Since games don't have to run with more than user privileges and steam runs in flatpak, you could run them as a different user account with very limited permissions.

That said, flatpak should be pretty secure as far as I'm aware if you make sure that permissions for the apps running are restricted appropriately. I'm not sure how restricted you can make steam and still have it work though

You can use offline mode for steam if you're okay with steam having internet but not games. But there's no way to use steam entirely offline. Internet access is a fundamental part of the system they have.

There's also a question of what your threat model is. Like are you trying to prevent causal access of your files by games, or like a sophisticated attempt to compromise the system conveyed through a game. For the former flatpak seems sufficient. For the latter you probably need a dedicated machine. And there's varying levels in between

Flatpak's security and sandbox has gotten much better in recent years. I've been using Steam via Flatpak for a while now and haven't run into any issues yet, other than not being able to make desktop shortcuts of my games.

I use Flatseal (another Flatpak application) to further restrict my Flatpak's permissions) The default Flatpak permissions for Steam aren't bad IMO (at least when compared to other Flatpaks) but you can tweak it to your liking using Flatseal.

If you want to take it a step further, I would recommend using Goldberg's Steam Emulator, which is FOSS, and it will allow you to bypass Steamworks DRM (which is Valve's very weak DRM) for games which solely use Steamworks DRM.

I find that the overwhelming majority of my games just use the Steamworks DRM if any, but YMMV. Using Goldberg's Steam Emulator is also a good way of preserving your library if, in the unfortunate case, Valve decides to remove a title from your library for whatever stupid licensing reason they come up with.

After freeing your games using Goldberg's Steam Emulator you then could use the Flatpak of Lutris and disable network access for Lutris/further restrict permissions it has to the rest of your system using Flatseal.

Intermediate route: pass through your GPU to a virtual machine running Windows or Linux+Proton. This is the strongest isolation aside from dual boot or using a second device, and runs almost as well as native. There are a lot of tutorials online but the archlinux wiki is a good place to start. This usually means you need a second GPU for your main system (an iGPU works if your CPU has it), or you can use janky scripts to switch the GPU between your main system and the VM. You also might need a KVM switch to switch your monitor and keyboard between your main system and the VM.

Expensive route: if you have two PCs you can set up one for game streaming using Sunshine, and stream games to your primary PC. Benefit of this approach is you can also stream to your tablet or android TV.

People are right about flatpak - it will generally keep stuff out of your actual root/home directory. But like you implied, the steam flatpak is unofficial so you may run into issues. With that said, I've used it and know many people who use it without any problems.

And depending on the game, you might be able to run it directly with steam offline, or even straight from the executable without steam open at all.

Of course this isn't airtight, but there are ways to check the permissions granted to flatpak applications. And IMO it works well enough for games. Ofc this depends on how paranoid you are and your reasons for wanting this (fear of a game being a virus, not wanting clutter in home, wanting protection from a bug that would delete data, etc.).

I'd have 4 main solutions I can think of, and that can be used together if needed:

• VMs for running Steam and for games that MUST use Steam.
• Emulators, wrappers and source ports for games that allow that, e.g. BSNES for running River Girls Zero, Joiplay / Artemis / EasyRPG / AquariaOSE for games that use compatible engines, etc.
• Having a separated computer you can use 100% offline (requires sideloading games)
• The annoying idea some users give that strays from the original question, but that I think that is valid for once - to get the games from places that openly distribute it DRM free

This is a topic I would like to do something about. I'm not comfortable running games with full access to my home directory.

I hope someone with firejail or bubblewrap setup can share their thoughts.