I just set PrivateTmp=yes on my user@.service, and just like that, every user session has its own /tmp - wonderful! (Solved Firefox using /tmp/firefox and hence colliding with other user's Firefox)
Update: Well, scratch that. At least gdm with Wayland seemed to have some difficulties, so I had to revert the setting (because I actually like to use Wayland)