Nice setup. I use CalyxOS with most of the apps I use being from Aurora. I'm sure you're familiar with it, but you can install most apps in the google store from Aurora, without using google credentials.

We have a sandbox type feature achieved by using work profiles, which can be paused when not in use.

We also have a firewall app that gives pretty grandular control over network accesses for installed apps. I still get push notifications about sales from apps that should effectively be completely disconnected from the internet. I haven't figured that out yet.

Thanks for the info!