Both work, all you need to do is make sure that you get an OEM unlockable device. If you buy at Google directly, this can be guaranteed, but you have to leave some data at Google which they could potentially link to the device. Alternatively, swappa is supposed to work as you can ask for OEM unlockable devices specifically.
If you want to go all in on privacy, buy it at bestbuy or another trustworthy store away from your home city, pay in cash, look for the next public WiFi, turn on OEM unlocking, turn off WiFi and shut down device. Back at home, you can install GOS without needing to connect to the internet again.
Homestly, buying at google is probably good enough for the start, and if you have a somewhat recent phone, you might get a nice trade-in deal.