The Owner profile has some unique abilities that can't be done from other profiles, including turning on/off the mobile hotspot.
While true, you can't turn it on on other profiles, you can still disable it by briefly turning airplane mode on.
Just for tethering you actually need to stay on owner profile.
For mobile data turning on and off I found a solution for secondary profiles. You can make a settings widget on your 2nd or 3rd profile for "Data Usage" there is a checkbox for turning Mobile Data on and off. I do not know why this option is hidden in the normal settings menu though, as if it is unintended to use this way.
I disable PlayStore and Playservices once I updated the few Playstore Apps I use, you could clear cache before letting them access Internet again. I am not sure how well this actually prevents these apps from aggregating data while in disabled use, and if Cache really deletes all their data, I doubt it, but nothing is perfect.
For your use case, that may be not suitable though, unless you are fine with accessing google messages only sometimes idk.
From what I understand, the connection you make via hotspot and tethering are not using the vpn of your phone, they need their own vpn connection on the device you are using them on. (But please correct me I am wrong, but I am pretty sure at least for tethering.) So all your phone should see is encrypted data that goes through the VPN. If they know what devices you are linked too, when you used it and for how long, is another question. I am not so deep into it, but nobody else was answering.
There is another setting in your VPN category, that it should block all traffic when the VPN is off for various reasons. If that is checked then you should have no leakage usually. But I would read up more on Orbot, I think it is no longer recommended as much, but I forgot why. Some of the SideofBurritos videos are a few years old already. I think he is using Mullvad as VPN later on, which is a one of the good choices.
This setting also would allow you then to turn the VPN off on your owner profile, while having mobiledata or Wifi still activated, your owner profile becoming effectively offline though - until you restore VPN connectivity.
So there are a few ways to prevent Playservices the access to internet.
You can use a hotspot while the VPN on your owner profile is off - while its traffic is blocked - while hotspot and the devices connected have internet - but like I said would need their own VPN connection if you want to prevent leakage of said traffic to your ISP.
Hope that helps at least a bit. Generally I would have advised against using your main google profile on your GOS device - but I guess for some scenarios it is hard to do and not as important. I think I would use Laptop or Tablet (for Microsoft or Google apps if necessary) or for Music a Walkman - to not expose myself to Bluetooth or USB-C attacks by compromised hardware. Which would be an idea.