Cheers on the guide, but can we clarify why this would be desirable?
I am not sure that much benefit is to be had from this in terms of security, though certainly some convenience comes from this (namely due to DAC permissions).
From the security angle, a virtual machine launched by libvirt qemu:///system runs as user “qemu” whereas one from qemu:///session runs as your Linux user. Beyond this I notice that for qemu:///session, virtqemud, virtstoraged and virtlogd all run without any type enforcement from SELinux (or any SELinux user/role enforcement); the virtqemud/virtstoraged/virtlogd processes run as root for qemu:///system of course, but they are constrained by type enforcement and are constrained by the SELinux ‘system_u’ (which isn’t meant to be explicitly mapped to a Linux user like sysadm_u or user_u).
All the stuff I can find out there is pretty generic high-level stuff- I wish I could pick Dan Walsh’s brain about this stuff 
I am going to be doing some more research on this and also on confined user accounts in the near future.