I've used Centos more recently and I've run BIND there. In Centos, I've made sure to not run the BIND user as root by adding the option in the /etc/sysconfig/named file, and that was pretty straightforward.
What's the best way to avoid running the BIND user as root on Ubuntu?