Successful sudo from a cgroup still makes you root on the machine. What you want for this is user namespaces, not (just) cgroups.

yes, you would setup namespace and unshare it once mounted to isolate the sandbox so root only sees the sandbox / and not your /