DeletedUser115 One way to do it is to install/update apps via Play Store in the Owner profile, then disable Play Store, Play Services and Play Services Framework apps. Use a secondary user profile as a daily driver where all your apps are installed and used.
That's my exact setup, except for the disabling part. Why do you recommend that? I don't use the owner profile (except for installations and updates) and never open the installed apps there (also revoked network and sensor permission for them), so there's not much to track. There's no Google in the user profile for the installed apps to use. Likewise, Sandboxed Google Play doesn't have access to the user profile where all the fun data is. Since I update apps regularly on the owner profile, I would need to enable the Google apps and their internet permission anyway.
So, is there any advantage in disabling the Google apps that I don't see?