How much filesystem permissions are too much?

It should be possible with the FileChooser portal. You can use it to request access to a folder. As long as everything required is inside the requested folder, it should work without filesystem permissions.