What you’re proposing is creating a Frankendebian, which Debian explicitly warns against doing. The proper way of getting security patches from unstable would be to pull the source debs and compile it yourself against the current Debian testing base.
This lane of thinking however seems to be completely misguided when it comes to the target audience here, that is, a user who is not even experienced with Linux in general enough to know about various rolling release distros. Telling a user this inexperienced to go with either of those is in bad taste at the very least.
banazir