monozygote
Thank you for that very detailed rundown! That looks like an enormous amount of work to go through, all for the "reward" of less security, less privacy and less compatibility compared to the work required to use Sandboxed Google Play cleverly. This reaffirms my choice to never use Aurora Store. And here I thought my process took a lot of work!
How I do it, for those curious:
I use a discrete "Play Store only" Google account with fake personal information to access the Play Store. I sign up for it on the Owner profile, over a "naked" connection (i.e. no Tor, no VPN, no DNS filter) on a coffee shop's free WI-FI so that I'm not asked for a phone number. Then the VPN goes back on, I sign in, install my apps (saying no to network access every time), disable all of them, then disable Play Store and Services.
Next, I sign into that same Google account in the VPN-protected private space of a secondary profile (let's call it "Being Evil"). I then install the same apps again into there, (not a big deal, I have less than ten apps from the Play Store). After that, I disable only the apps which are tracker-free, ad-free, potentially dangerous and VPN-hostile, I keep Play Store and Services enabled, then switch back to Owner.
The next thing I do is push the Play Store apps into their appropriate profiles via Settings → System → Users. Being Evil's "parent space" (for lack of a better term) does not have a VPN running. VPN-hostile apps, like banking apps, go here, along with Play Services (but not Play Store). VPN-friendly apps with ads and trackers stay enabled in the private space I installed them in. Potentially dangerous apps with insane permissions are pushed into an ephemeral Guest profile on the rare occasions when I absolutely need to use them. What remains are the immaculate apps, which are pushed into my non-evil secondary profile.
All of the above is a minor hassle, I'll admit, but from this point on, it's easy street. All I need to do to update my Play Store apps across all of my user profiles is to open Play Store in Being Evil's private space, manage apps, update all, and it's done. If I need a new app, I temporarily re-enable Play Store and Services in Owner and repeat the process.
Improvements, suggestions, warnings and criticisms are welcomed and appreciated. I'm drafting a step-by-step guide to this process and I want to ensure I have everything accounted for before I unleash it.