Good security practice for remote to local backup using rsync

Question

I would like to perform a manual backup of a remote VPS (Debian 12) to my laptop using rsync. I want to backup the single files and directories to easily inspect them locally, and not e.g. a VM snapshot.

The VPS' filesystem is not really large, I do not need to backup all of it but quite a few directories that require root read permissions (many /var and /etc subdirs at a very minimum, including some files with -rw-rw---- permissions such as certain secret keys and certificates). I don't really care if user permissions are not kept from VPS to laptop. ssh on the VPS is quite hardened (only one user allowed, no root, passwordless etc). The VPS user can eventually sudo.

Easy solution would be to enable passwordless ssh root login and rsync from my laptop to the server using root, but I don't really like the idea.

I thought maybe a slightly better option could be:

1. create a "backup" user on the VPS without /home
2. add it to the root group
3. enable passwordless ssh login for it, but
4. use the ssh option that limits the kind of commands that this user can run

Is there a better option? If not, how do I do (1)-(4) above correctly?