I would have them run as a user that does not have sudo. The easiest way to do this is by using system-level Podman Quadlets that run as an unprivileged user account. That user will need a real home directory for images and volumes.