user restricted to particular directory

[jiun bookworm]

I have an application   running as  user "app" with a  home directory in
/ap/app
i'd like to restrict the application (started as a service so there's no
ssh/console login) to
/ap/app, with access to  other binaries  in  /ap/python  and
/opt/support-app   and access to a high  port on localhost,  what would be
the best way to do that?
it does not need read/write  access anywhere else only in subdirectories of
/ap/app