-Google Play Services vs. alternative app stores like F-droid have benefits and drawbacks. In particular, F-droid's signing mechanism has drawn criticism (including from outfits like Signal).
-One of the strongest controls I've instituted is using private DNS so I can see and control a lot of the calls the phone makes. Easy to set up with a service like NextDNS, but can also roll your own.
-If DNS feels a bit too far, check out PCAPDroid as it can provide some separate functions.
@neurovagrant thanks a lot for your feedback. I'll read more about both options