Although cgroups seemingly allow to control the CFS bandwidth of a cgroup, I don't see a way of enforcing a cpu time limit on a cgroup. The use case is that I would like to catch student programs that e.g. go into an infinite loop.
You can use the information from this Red Hat page if you want to stick to Control Groups, but I think your
ulimit solution is a reasonable approach and doesn't require the configuration that cgroups would require (just add one command to
/etc/profile and you're good).