Is it possible to allow sideloading and keep users safe?

Yes if the os sandboxes everything. If you choose to give it access to a file it can mirror that file so that any edits can be undone. Sure it uses more space but way safer unless they find a jailbreak outta their sandbox.