Kick secure has released a nice feature that splits root user and normal user and you can test it in QubesOS

https://forums.kicksecure.com/t/kicksecure-template-for-qubes-testers-wanted/1020