Pavestone2734
The best approach is keeping things simple and there's a lot to unpack here. Nobody can tell you what the best is for you, because that's your decision. You have to decide why you want isolation with profiles, based on how you have threat modeled.
No login is global, you are correct you must unlock the owner profile to access additional profiles. Each profile is essentially another device after that - each can have their own set of logins.
You do not have to use the same type of login styles (pin/password/2FA) if you don't want. 2FA is cool, but it is intended for higher threat models. That doesn't mean anyone can't use it. But why do you want/need to? Yes, if you use it you have a password for each profile, then a pin beyond biometrics. So you want to start remembering all that?
Yes, you can set the same pin or password for every profile if you want. Obviously then login compromise allows access to everything. You can leave additional profiles running in the background or shut them down completely when you don't use them. This creates different login requirements based on how a user interacts with them.
I believe I've seen users here recommend 90bits of entropy for a diceware password so that starts at 8 words.
I'd suggest sitting down and identifying why you want profile isolation, what you're trying to safeguard and how your ideal workflow is. This all influences profiles/login styles.
You can even start with a single profile and while you use your device start to push apps to additional profiles. Then decide what login style you want to access said profile.