For quotas, you'll probably need to create a new interpreter to run the quota'd code, plus the permission to actually create a new interpreter. It may be possible to temporarily drop into a piece of code and impose quotas on it without a new interpreter, though once that code exited the quotas would go away. Might be sufficient for one-shot usage.

The rest of the stuff--security, tainting, permissions--probably won't need to have a separate interpreter, at worst needing to drop into another runloop temporarily.

In no case will you need a separate binary, unless you've hacked the heck out of the stock source distribution. A proper safe mode will ship as part of the standard distribution.