Comment by MrDrMcCoy

You can easily override the service unit to confine it to an unprivileged user and then assign the net admin syscap do it can do what it needs to do.