Just denying write access outside the build directory and denying network access would go a long way and won't break pretty much any well-behaved build systems.

Any C library that's also packaged by debian supports being built under these conditions because it's required for everything except non-free packages: https://www.debian.org/doc/debian-policy/ch-source.html#main...