I managed to make a priv-app running in its own domain. But it seems the custom domain had not inherited standard rules from appdomain. I'm using Magisk to inject and patch the SELinux policy. The app won't start at all.
sepolicy.rule
type battery_app domain
allow battery_app battery_app * *
allow battery_app app_data_file * *
allow battery_app sysfs * *
I don't know how to further sandbox the priv_app domain using Magisk, and inheriting priv_app rules.