Both SeLinux & Anti-virus/rootkit-hunters should be used.
SeLinux is a tool for keeping users and services in check though the use of profiles. Think of it kinda like a file system firewall because when improperly configured their equally useless. When setup correctly it can cause premature balding in attackers that stress out over such things.
Antivirus software generally only protects against known and nonpolymorphic locally executable code. And will fail to protect against software lives in memory or software that touches it's own bits such as those compiled with movfuscator that are intentionally designed to not only defeat antivirus but also reverse engineering attempts by malware analysis tools. In other words antivirus only really protects against "script kidies" and their ilk.
For production servers I'd suggest something for your kernels' security (the only currently known tool to mitigate against some forms of 0-day exploits) in addition to above mentioned; see the GrSecurity kernel patch and it's PaX control friends. Warning this is the highest difficulty suggestion listed in this post, however, it's also a pain in the butt to attack systems with this level of security. So definitely check into it.
For any remote servers, some form of intrusion detection system (IDS) such as tripwire should be in place prior to allowing other users on. And for persistently networked servers it would behoove you too consider setting up a snort box to monitor network traffic.
For user process segregation I've found that firejail is compatible with above listed suggestions and when setup correctly provides a lower overhead cost and much smaller dependencies list to keep updated than other sandboxing/virtualization options on the market that provide similar levels of control.
All that being said if someone wants to pop your box and has sufficient time, resources & access, then, your box will eventually get popped. So encourage your clients/users to be making encryption and off site backups a priority. These final layers of security are a bit tougher to have implemented on a multi-user server so the one experimental option I'll leave for your consideration is a tool I'm writing for server access log asymmetric encryption Paranoid_Pipes a bash script that allows remote servers to write logs they'll never be able to read from in clear text again.
One option similar to the last one listed but not advisable for this question because of the "sensitive intimation" stipulation would be the file system from https://keybase.io but because you're handling private stuff it would be best if ya kept it off third party storage no matter the encrypted state and preform local encryption and backup over secure channels such as sshfs mounts.