In such case of Mac OS, watch through the program he/she downloads as usually those .dmg are executable files and may access uncontrollable if the account is Admin.
I think you need to consider running Mac Antivirus which isn't bad idea, even though it includes Windows signatures detection therefore any assurance that will not run due to OS environment.
Whoops... Let my clarify. I should say that if you don't enter your username/passcode then you can't install software. Of course, the software can still download.
However, that's not to say that Mac doesn't get malware. For example, if you get a pdf file with viruses in it, or a trojan acts like a legitimate file and you try to install it. Browser Ransomware is also a problem.
Still, the biggest problem is
phishing threats as those are not depended on OS or even download/installation. So watch out for phishing threats by using Bitdefender TrafficLight or WOT (or Adguard For Mac if you are willing to pay money).
As For OS X Security, based on the above. I would recommend installing OS X Antivirus.
Preferably Sophos, since it's free and I adore it. I'm using ESET CyberSecurity only because I have a license sitting out there and decided to use it instead of Norton which I decided was a no-no in my trial. Sophos AV however is still my choice for mac antivirus.
Back to the OP's question, and the above, I would suggest running Sophos Home Edition For Mac for your friend. However, to go for a sandbox might be overkill (and there are no standalone sandboxes like Sandboxie for Mac). If you really are interested in a sandbox for your friend, the Webroot SecureAnywhere bundle for mac includes a sandbox if I account right.