Is their any way to control or limit mac applications from creating files and directories that aren't necessary or are malicious?
You might want to look into macOS’s built-in sandbox-exec. It can be used to run any command in a “sandbox” in which it can be denied access to the network, prevented from writing files in certain locations and so on.

At the bottom of this answer there’s a sandbox profile “firefox-sandbox” that was featured as an example on Mac OS X hints of running Firefox in a sandbox where its ability to write files is (mostly) limited to your Downloads folder. I should note the hint is a few years old, the sandbox profile may require some fiddling for recent versions of macOS and Firefox, I did not try it. The hint says Firefox can be run in the sandbox through:

sandbox-exec -f firefox-sandbox /Applications/Firefox.app/Contents/MacOS/firefox-bin


Some other links you may want to look at that cover sandbox-exec:


How to run your Applications in a Mac OS X sandbox to enhance security
OS X: Run any command in a sandbox
Apple's Sandbox Guide


Here’s the “firefox-sandbox” file:

(version 1) 
(deny default)

(allow file-write* file-read-data file-read-metadata
  (regex "^/Users/user_name/Downloads")
  (regex "^/Users/user_name/Library/Application Support/Mozilla")
  (regex "^/Users/user_name/Library/Application Support/Firefox")
  (regex "^/Users/user_name/Library/Preferences")
  (regex "^/Users/user_name/Library/PreferencePanes")
  (regex "^/Users/user_name/Library/Caches/Firefox")
  (regex "^/Users/user_name/Library/Caches/TemporaryItems")
  (regex "^/Applications/Firefox.app")
  (regex "^(/private)?/tmp/"))

(allow file-read-data file-read-metadata
  (regex "^/dev/autofs.*")
  (regex "^/Library/Preferences")
  (regex "^/Library/Internet Plug-Ins")
  (regex "^/Library/PreferencePanes")
  (regex "^/usr/share/icu")
  (regex "^/usr/share/locale")
  (regex "^/System/Library")
  (regex "^/Applications/Firefox.app")
  (regex "^/usr/lib")
  (regex "^/var")
  (regex #"Frameworks/SDL.framework")
; Our Module Directory Services cache
  (regex "^/private/var/tmp/mds/")
  (regex "^/private/var/tmp/mds/[0-9]+(/|$)")
  (regex "^/Users/user_name"))

(allow mach* sysctl-read)

(import "/usr/share/sandbox/bsd.sb")
(deny file-write-data
   (regex #"^(/private)?/etc/localtime$"
     #"^/usr/share/nls/"
     #"^/usr/share/zoneinfo/"))

(allow process-exec 
  (regex "^/Applications/Firefox.app"))

(allow network*)