Loginctl/per-user systemds are for managing interactive sessions. System services with User= is exactly the way you'd go for isolating background daemons.
Does this let them modify the unit file, create units, create timers, etc?
User systemd allows that kind of complete self-service, and so lets you do application deployment and management without touching the root account, which is rather nice.
