Bottles sandboxing is done by turning on experimental sand boxing somewhere in settings. It does mean you’ll have to copy any installers into the c_drive of that bottle to execute. You can also optionally remove networking from a bottle (I do this for all singleplayer games)