You can use sandbox feature and allow loadstring to be used.
You can use RemoteFunctions/Events to call API althrough that a server side only.
I made a post about that Modding in your expirience! (And game script communication)
Althrough if you want 100% control you probably have to write VM/modify someone else’s VM