Restricting Emacs server-mode socket access to a single user on a shared host

Goal

On a multi-user Linux host, I want to run Emacs with server-mode enabled so that emacsclient works for my account, while guaranteeing that no other local user can connect to my editing session.

Current understanding

As far as I can tell, the server creates a Unix domain socket under /tmp/emacs<UID>/server, and Emacs itself provides no built-in authentication or access control list for it. Access control appears to depend entirely on filesystem permissions of the socket directory. Enabling server-use-tcp would make things worse, since TCP mode has no encryption or authentication either.

Uncertainty

I am unsure whether the default permissions on the socket directory are already restrictive on modern Emacs versions, or whether they vary by platform and umask. I also do not know if there is a supported way to relocate the socket directory (for example into a private $XDG_RUNTIME_DIR path) without breaking emacsclient discovery.

Questions

1. Does current Emacs create the server socket directory with owner-only permissions by default, or must this be hardened manually?
2. Is setting server-socket-dir to a private directory the recommended approach, and does emacsclient honor the same variable automatically?
3. Are there any side effects of chmod 700 on the socket directory for desktop integrations or systemd user services?