How can I mark an arbitrary file as Restricted (using SIP)?
You'll need to first disable SIP temporarily by booting up in Recovery mode (or any similar means).

Then either add the extended file attribute com.apple.rootless to the file, you want to protect - or add it to /System/Library/Security/rootless.conf.

After you reboot into ordinary macOS, the file should be restricted by SIP.