Is this better than using sandbox-exec (on mac) directly?

Hmm, I don't know about better, more convenient I guess. But if it floats your boat you could write out everything in the sb format and call sandbox_exec()!