Kyc and non kyc, separate xpubs, yes

A cold one and a room temperature one.

I like the idea of having multisig and one key with you that has a part of your stash

Definitely. One for kyc and one for nokyc