Don’t give them access to your same WiFi that the Sonos is set up on. Most routers have the ability to set up ‘guest’ WiFi networks, which don’t allow access to any other devices on your LAN. 

And if you feel you can’t trust folks not to mess with your Sonos, they probably shouldn’t have access to your LAN anyway, there are likely more important things to be safeguarding than Sonos access.

Sonos does have a gate to making system changes, of course, but not simple ‘playing music from already installed music services’. 

If you’re in a shared dwelling, with a common WiFi, get a travel router. Connect the travel router to the main WiFi, and use it to set up a private network for yourself.