Good video and I could be wrong, but I believe the whole point of gOS sandboxed play services, is that apps can't leak data to other apps. So creating a separate user account just for play services is not needed, unless you want separate users for reasons other than data privacy. Also, regardless of sandboxed services, data given to apps downloaded from gplay store is still sent to those apps. Just something to keep in mind.