One of the cleanest ways to do what you want is to create a D-Bus-activated systemd service (or socket-activated, if that's more appropriate). That allows activation completely outside the user's session without elevated privileges. Of course, it requires considerable work for each service to do it right.