I mostly use user accounts on locked devices that can only show the HA app with views specifically designed as such, which in turn limits the devices/entities viable to them.