Start process so that it can’t spawn new ones

This sounds like a job for a Mandatory Access Control system like SELinux or AppArmor.

This article on SELinux will give you some idea of how powerful such systems can be, and the tools you need to develop such policies.

Beware, your wish to restrict access to all files is likely to backfire on you. In Unix "everything is a file," so entirely preventing all file access will prevent your program from even starting. A more productive approach will likely be to restrict file writing, either entirely or to only a specific directory, and to whitelist categories of files the program can legitimately read.

Another option is to use chroot or jails. With these OS features, instead of preventing file I/O or program execution, you would simply build a restricted environment where there is nothing sensitive for your untrusted program to read, write or execute. Your program could only operate on the files you put into the "box" with it.