I can't use the sandbox-exec command as I expected.
The problem is that I cannot apply a custom profile with the -f switch: I get "operation not permitted" error which I could not trace to anything useful when I searched online for a solution.
$ sandbox-exec -f alfred-profile.sb /Applications/Alfred.app/Contents/MacOS/Alfred sandbox-exec: /Applications/Alfred.app/Contents/MacOS/Alfred: Operation not permitted
It is, however, possible to run pre-defined profiles with the -n switch. The following example runs successfully (starts Alfred and does not allow the process to access the network).
$ sandbox-exec -n no-network /Applications/Alfred.app/Contents/MacOS/Alfred