Emacs-lisp is near non-negotiable if you want to have full org-mode.

You can use sandboxing to limit the security brain damage. I like LXC: http://en.wikipedia.org/wiki/LXC