setting up a graphical session with a non-root user and sandboxing Jellyfin media player would be relatively easily, for example using only flatpak, you could sandbox it so it only has access to your media path.