On Windows, it's not really doable. It is possible on linux with mandatory access control (for example). So you can have a web filter running, but the sudoer wouldn't be able to interfere with it (at least not without lots of effort, potentially rendering the system inoperable). At the same time a sudoer can modify virtually everything else.
I can’t see any way you could accomplish this without rewriting the OS and security models.
The accessing a specific folder will be trivially handled when you encrypt the contents of a folder or file and don’t share the key to unlock the data on APFS. Since you can’t keep the root user from reading a file or folder, and admin user can become root (that’s the definition of Admin user on macOS) therefore anything one admin user can set, another can undo.
I can’t see a case where you wouldn’t just make the user not an admin and carve out a way they can do whatever admin things you want them to do by granting additional access and just not granting admin status to the users you don’t trust.