How to set up a server for access by a familiar person?

Question

Debian

Greetings! There is a home server on debian, a router on openwrt and a white ip. I want to give the entire server to a friend (all his computing power) for a candy bar. I have some questions:
1. Since the server is home, you need to prohibit access to the home network and the router itself.
2. It is necessary to protect the server itself from crooked hands, somehow isolate the user from the hardware.
3. In order not to fill the entire channel with torrents, you need to set the connection speed on the router.
There will probably be a game server on the server, so performance is important.
I will accept any links on this topic. Thanks in advance!

Answer 1

Protect from crooked hands with a container. Do not let him into the system itself, make him an lxc-basin. Since the basin will have its own address, limit this address to what and how you want over the network.

Answer 2

Everything is solved by iptables on the router. Some ports just block (torrent), some you forward, that's it!

Answer 3

I have it implemented in the form of virtual machines. Raised a virtual machine, forwarded the port for access via ssh / rdp and everyone is happy, isolated and resources are limited in the right quantities. And inside virtulaki and root / admin rights can even be given without unnecessary risks.