Another thing you can do is just run a container or a specific backup user. Something like with a systemd-nspawn can give you a pretty lightweight chroot "jail" and you can ensure that anyone inside that jail can't do any rm commands.

  pacman -S  arch-install-scripts            # Need this package (for debian you need debootstrap)
  pacstrap -c /mnt/backups/TestSpawn base    # Makes chroot
  systemd-nspawn -D /mnt/backups/TestSpawn   # Logs in 
  passwd                                     # Set the root password. Do whatever else you need then exit
  sudo ln -s /mnt/backups/TestSpawn /var/lib/machines/TestSpawn
  sudo machinectl start TestSpawn            # Congrats, you can now control with machinectl

Configs work like normal systemd stuff. So you can limit access controls, restrict file paths, make the service boot only at certain times or activate based on listening to a port, make only accessible via 192.168.1.0/24 (or 100.64.0.0/10), limit memory/CPU usage, or whatever you want. (I also like to use BTRFS subvolumes) You could also go systemd-vmspawn for a full VM if you really wanted to.

Extra nice, you can use importctl to then replicate.