GrapheneOS. GApps including playstore is sandboxed away from OS. You can set permissions for playstore since it is now am app on its own and not baked into OS. You can add more profiles and have certain apps in their own sandbox if you fear apps sharing info between them. You also get a microphone off and camera off button.