I tested the following systemd security settings and found them to allow normal
operation on my system while providing less exposure to the system in the case
of security issues.

[Service]
SystemCallFilter=~@cpu-emulation @debug @module @mount @obsolete @raw-io @reboot @swap
UMask=077
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_FOWNER CAP_FSETID CAP_SETGID CAP_SETUID CAP_SYS_NICE CAP_SYS_TIME CAP_SYS_TTY_CONFIG
ProtectSystem=full
ProtectKernelModules=false
RestrictSUIDSGID=false
NoNewPrivileges=true
RestrictNamespaces=true
ProtectKernelTunables=true
MemoryDenyWriteExecute=true
ProtectHome=true
ProtectHostname=true
ProtectKernelLogs=true
PrivateTmp=true
ProtectControlGroups=true
PrivateDevices=false
ProtectClock=false
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_PACKET AF_NETLINK

LockPersonality=true
SystemCallArchitectures=native