Eirikr70 a common recommendation (from a security standpoint) is to dedicate the owner profile solely to installing apps through the Play Store and Obtainium. You could choose to use a throwaway Google account for this if you wish. Apps installed on the owner are available on other user profiles regardless if they have Play services installed or not.
So, you can selectively push each app install to other user profiles. You handle this in the multiple Profiles section of settings while on the owner profile.
So a common set up would be:
- Owner: Install apps from Play Store
- User 1: Main profile no play services
- User profiles 2-16: secondary profiles for compartmentalization, with or without Play Services, that may or may not be disabled in the background
For google play services on the owner, you shouldn't need to enable any other permission besides for network permission in order to get the play store working. You can simultaneously disable everything else on that profile such as location, microphone, camera, etc. The only real info you'd be sending to Google from that profile is the list of apps you've installed. You can also minimize this further by using a throwaway Google account and keeping a VPN running on that profile.
Some may choose to disable installed apps in the owner and only enable them in order to update them. You can still use the apps in another profile even if it's disabled in the owner profile. Others may choose to disable wifi/mobile data on the owner as well and only turn it on to manually update apps. With so few background processes happening, this setup shouldn't affect battery life that much compared to only using one profile.
If you really don't want to use Google and are willing to sacrifice some security, you can use the aurora store on the owner instead, which won't require Play services. Though, some apps won't work unless they were installed from the Play Store directly, like some banking apps.