tornsail Hey I know this issue was solved a couple of weeks ago, but it's actually regarding your last point where you say you keep GPlay Store + Services disabled, except when you install or update an app, after which you disable it again. As I'm sure you've found, an issue with keeping it disabled is the fact that you might not know when certain apps actually need to be updated, and they won't automatically be updated, except while GPlay Store is enabled.
I have a small guide for an alternative way to keep them updated, if you're interested.
You may find this makes it easier to keep the apps that were installed by Play Store updated, while also keeping Google Play Store + Services in your main profile disabled as much as possible.
Make a new user profile and call it something like 'GApps Updater'. In this profile, install Google Play store + Services, then sign into it with the same account that's signed in on your Owner profile. After setting up this user profile, go to the Manage users / Multiple users menu on your Owner profile. Then make sure Allow running in background & App installs and updates are both enabled for your GApps Updater profile.
Then, when you next install an app from the GPlay Store on your Owner profile, tap the little down arrow on the right side of the Install button, which gives you the option to install on more than one 'device' that you are signed in to. Make sure that, as well as 'This device', the other 'device' is ticked as well (it will appear as the same phone model you are using, this is the GApps Updater profile). Once ticked, some text will appear - Save app sync preferences. Tap that text, so in future you can just tap the install button as normal.
From then onwards, every time you install an app using the GPlay Store in your Owner profile, it will automatically queue itself to be installed into the GApps Updater profile, next time you open that profile.
Let's say, you just installed Spotify in the Owner profile. When you next open the GApps Updater profile, after a few seconds, a message will pop on screen, Spotify: Do you want to install this app? After you tap Install, and the app has finished installing, long press on the new Spotify icon that will have appeared on your homescreen, then tap App info. Now that you are in the App info settings menu for Spotify, tap Disable, as you don't want to actually use any apps on this profile (or have them running in the background at all), it will only be for updating your Play Store apps.
Now once every 1 - 2 days, you can open this profile and it will update your Play Store installed apps automatically, in the background. Since an app updated in one profile, is updated across the entire device, you can pretty much just let it do it its thing while you switch back to whatever profile you were on before. I recommend turning on notification forwarding so you can still be notified about anything that might require your attention.
Two quick things to add.
One - you may want to / generally prefer installing an app from inside the GApps Updater profile, and then temporarily enabling GPlay Store in the Owner profile to let it install there. Just be aware you will have to tap the down arrow on the right side of the install button, tick both devices and save sync preferences on that profile as well, as it doesn't automatically work both ways.
Two - for any apps that were already installed by Google Play Store before you made the GApps Updater profile, the best way to get these apps into the new profile and get them to update automatically, is to open GPlay Store on your Owner profile, tap your account's profile picture / initial in the top right —> tap Manage apps and device —> tap the Manage tab at the top (next to Overview) —> here you will see your installed apps. Tap on each app here. Underneath the uninstall button you will see the text Available on more devices and under that there will be your device model, with an Install button next to it. Tap each app in turn and tap that Install button. (There are multiple other ways of achieving this, including using the Manage users menu to install each app into the GApps Updater profile, but that will cause a very slight issue as the first time each of these apps needs to update, it will not be able to automatically, until you have tapped yes, whereas, this way, it means after waiting for each app to be installed in that profile by Google Play Store and tapping yes, they will then update automatically in future, whenever they happen to receive updates. It just gets that initial permission for GPlay Store to automatically update all apps in the background, out of the way).
Anyway just thought I would share that method with you as it's one way of keeping stuff up to date with your configuration :)