Systemd Mitigation

What is the best way to mitigate systemd’s attack surface within whonix-16? Can this be done
using an app armour profile? How can I verify this?